Outside In Technology CVE-2026-91459

Exploitation requires (1) the Oracle Outside In Image Export SDK version 8.5.8 to be deployed/embedded in the target application, (2) the attacker to have logon access to the infrastructure where Outside In executes (local vector, AV:L), and (3) human interaction from a person other than the attacker (UI:R) - specifically a user or service must open/parse the attacker-supplied image or document through the Image Export SDK. The LOCAL attack vector and mandatory victim interaction are the primary limiting factors: there is no evidence of remote network-triggered or fully automated exploitation. Risk is concentrated in deployments that feed untrusted files into Outside In for conversion, preview, or indexing.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a local, low-complexity vulnerability requiring no privileges but mandatory user interaction, yielding full confidentiality, integrity and availability loss ('takeover'). The attack vector is LOCAL (AV:L) despite PR:N: the description clarifies the attacker needs 'logon to the infrastructure where Oracle Outside In Technology executes' and that 'successful attacks require human interaction from a person other than the attacker' - this is the classic Oracle Outside In file-parsing pattern where a victim processes an attacker-supplied document/image. No EPSS score, KEV listing, or POC is present in the provided data, so there is no evidence of active exploitation or public exploit code. The 'Information Disclosure' tag understates the actual impact, which per the CVSS vector and 'takeover' language is full code-execution-level compromise, not mere disclosure. Net assessment: a genuinely serious code-execution flaw in an embedded document-processing component, but real-world urgency is tempered by the LOCAL vector and the hard requirement for victim interaction (opening/processing a malicious file). This is not drive-by remote exploitation; it is a client/server-side file-parsing bug. Absent EPSS/KEV/POC signals, treat as a standard patch-cycle priority rather than emergency, unless Outside In is exposed to untrusted documents in your environment.

An attacker crafts a malicious image/document and gets it processed by an application that embeds Oracle Outside In Image Export SDK 8.5.8 (e.g., a document-conversion or preview service). When a user or service parses the file, a memory-corruption condition in the Outside In parser is triggered, allowing the attacker to compromise and take over the Outside In process. No public exploit code is identified at time of analysis, and exploitation requires human interaction from someone other than the attacker (AV:L/UI:R).