Oracle Outside In Technology CVE-2026-91458

Exploitation requires a victim with local access to the system (AV:L) to open or process an attacker-supplied crafted file through Oracle Outside In Technology 8.5.8 - the flaw cannot be triggered remotely over a network and demands human interaction from a person other than the attacker (UI:R). The key limiting factors are: the attacker needs no authentication (PR:N) but cannot act alone, so a social-engineering or document-delivery step is mandatory; the vulnerable code only executes when a host application actually feeds untrusted content to the Outside In parser, so systems that do not ingest external documents are not at practical risk. Only version 8.5.8 is stated as affected.

CVSS 3.1 base score is 7.8 (HIGH) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting a local attack vector that requires victim user interaction but no authentication, yielding full confidentiality, integrity and availability loss ('takeover'). This is the classic profile of an Oracle Outside In file-parsing flaw: the attacker cannot reach it remotely over the network - exploitation hinges on a target user opening or processing a crafted file through a product that embeds the Outside In libraries. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; the 7.8 is severity-driven rather than threat-driven. The practical priority is therefore moderate: high technical impact if triggered, but gated by local access and mandatory human interaction, which argues for patch prioritization on systems that routinely ingest untrusted documents rather than emergency remediation. Note the input tag 'Information Disclosure' understates the flaw, which the Oracle description characterizes as full takeover (C:H/I:H/A:H), not merely disclosure - treat the impact as complete compromise.

An attacker crafts a malicious document (e.g. an office, image, or archive file in one of the many formats Outside In parses) and delivers it to a victim via email or a shared location. When the victim opens or the host application auto-processes the file through Oracle Outside In Technology 8.5.8, a parsing defect is triggered, resulting in compromise of the Outside In component in the user's context. No public exploit code is identified at time of analysis, so this scenario is inferred from the CVSS vector (AV:L, UI:R) and the product's known role as a file-conversion/viewing library.