Oracle Outside In EUVD-2026-106438

Exploitation requires that an application using Oracle Outside In Technology 8.5.8 (Outside In Core) parse an attacker-supplied, specially crafted document - the attacker delivers the file over HTTP (AV:N) and no authentication is needed (PR:N), but a person or automated process other than the attacker must open/process that file (UI:R), which is the key limiting factor. No special non-default configuration is called out in the description; the practical exposure is bounded by whether the deploying product feeds untrusted documents into Outside In and whether a human/pipeline triggers the parse. Only version 8.5.8 is stated as affected.

This is a credible high-priority issue, though not a drop-everything emergency absent exploitation evidence. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a low-complexity, network-reachable, unauthenticated flaw yielding full compromise (takeover) of Oracle Outside In Technology, consistent with a document-parsing memory-corruption bug in a file-conversion library. The single meaningful limiter is UI:R - a human (or an automated pipeline acting on attacker-supplied content) must process the malicious file; this is why it is 8.8 rather than a 9.8 fully-automatable RCE. No EPSS score, KEV listing, or POC indicator was provided in the input, so exploitation likelihood cannot be quantified: no public exploit identified at time of analysis, and there is no evidence of active exploitation. Note a metadata conflict worth flagging to the vendor/triage: the input Tag 'Information Disclosure' understates a vulnerability that NVD/Oracle rate as C:H/I:H/A:H full takeover - treat this as a code-execution/takeover issue, not merely disclosure. Because Outside In is an embedded SDK, real exposure depends heavily on which downstream products bundle it and whether they expose it to untrusted documents.

An attacker crafts a malicious document (e.g., a specially-formed office/graphics/archive file) and delivers it over HTTP to a service that uses Oracle Outside In Technology for content extraction, preview, or conversion. When a user or an automated processing pipeline parses the file, a flaw in the Outside In Core parser is triggered, leading to full compromise of the Outside In component. No public exploit code is identified in the provided data, and exploitation requires that the victim actually process the attacker's file (UI:R).