ZDI-26-636: Oracle Outside In Technology PostScript File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2026-60412 is a flaw in the Outside In Core component of Oracle Outside In Technology 8.5.8, a document-parsing engine distributed as part of Oracle Fusion Middleware; the CVE is classified as CWE-502 (deserialization of untrusted data), while the related ZDI advisory (ZDI-26-636) describes it as a heap-based buffer overflow triggered when parsing PostScript files. The attack vector is local (AV:L): an unauthenticated attacker must have logon to the infrastructure where Outside In executes, and successful exploitation additionally requires human interaction from someone other than the attacker, typically a user or service processing an attacker-supplied file. A successful attack can result in takeover of the Outside In Technology instance with high confidentiality, integrity and availability impact (CVSS 3.1 7.8), and the ZDI advisory characterizes the outcome as remote code execution. The affected version in Oracle's advisory is 8.5.8, so organizations running this release directly or bundled inside Oracle Fusion Middleware products are in scope. Exploitation has not been observed: there is no public proof-of-concept, the CVE is not in CISA's KEV, and EPSS assigns only a 0.3% probability of exploitation within 30 days (22nd percentile).

Do: Apply the Outside In Technology fix from the Oracle Critical Patch Update covering this CVE, upgrading 8.5.8 to the patched release Oracle identifies and updating any Fusion Middleware products that bundle the engine. Until patched, restrict which accounts can perform Outside In document conversions and limit processing of untrusted PostScript and similar files, since exploitation requires local logon plus user interaction. No public PoC or in-the-wild exploitation is known, but monitor Oracle support notes for the exact patched version and dependent product updates.