Oracle Outside In CVE-2026-91460

Exploitation requires that the Outside In Image Export SDK (version 8.5.8) actually process an attacker-supplied file - this means the component must be deployed and reachable by a conversion/preview/export workflow, and a user or automated process other than the attacker must open or process the crafted file (UI:R). The attack vector is LOCAL (AV:L): the attacker needs logon access to the infrastructure where Outside In executes, or a means to deliver the malicious file into a workflow running there. Limiting factors that reduce real-world risk below the raw 7.8: mandatory human/process interaction, no network-remote trigger, and the need for the specific vulnerable SDK and version to be in the file-handling path.

This is a genuinely high-severity but exploitation-constrained issue. The CVSS 3.1 base score is 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning the attack vector is LOCAL (AV:L) and requires user interaction (UI:R), not a remotely-reachable network exploit - the high score is driven almost entirely by the full confidentiality/integrity/availability impact (C:H/I:H/A:H) and 'takeover' outcome, not by ease of remote reach. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a tension worth flagging: the CVSS vector lists PR:N (no privileges) yet the description says the attacker needs 'logon to the infrastructure where Oracle Outside In Technology executes' - Oracle scores file-parsing SDK bugs this way because no application authentication is needed to craft the malicious file, but practical exploitation still requires getting a crafted document in front of a victim process on the host. Treat this as a patch-in-normal-cycle priority: real impact if triggered, but the local vector plus mandatory human interaction substantially limits opportunistic mass exploitation.

An attacker crafts a malformed image/document file designed to trigger a memory-corruption flaw in the Outside In Image Export SDK parser. A legitimate user or server-side process on the host (e.g., a content-conversion, archiving, or eDiscovery pipeline that embeds Outside In) processes the attacker's file, triggering the vulnerability and leading to compromise of the Outside In component. No public proof-of-concept was identified in the provided data, and the local vector plus required human interaction make this a targeted rather than drive-by scenario.