ZDI publishes four Oracle Outside In Technology file-parsing RCE advisories (CVSS 7.8) requiring user interaction

On 2026-09-09, the Zero Day Initiative disclosed four CVSS 7.8 remote code execution flaws in Oracle Outside In Technology file parsing — PDF (CVE-2026-60392), PostScript (CVE-2026-60412), GEM (CVE-2026-60413), and WPS (CVE-2026-60414) — all requiring a user…

The Zero Day Initiative published four advisories on 2026-09-09 covering remote code execution vulnerabilities in file parsing within Oracle Outside In Technology, each rated CVSS 7.8. ZDI-26-635 (CVE-2026-60392) is an integer overflow in PDF file parsing; ZDI-26-636 (CVE-2026-60412) is a heap-based buffer overflow in PostScript file parsing; ZDI-26-637 (CVE-2026-60413) is an integer overflow in GEM file parsing; and ZDI-26-638 (CVE-2026-60414) is a memory corruption flaw in WPS file parsing. In every case, successful exploitation allows remote attackers to execute arbitrary code on affected installations, but only after user interaction — the target must open a malicious file or visit a malicious page. The advisories report no in-the-wild exploitation (stated explicitly for ZDI-26-636, ZDI-26-637, and ZDI-26-638; the ZDI-26-635 report does not state an exploitation status). No disagreement on ratings, attack requirements, or affected product exists across the four reports.