ZDI-26-638: Oracle Outside In Technology WPS File Parsing Memory Corruption Remote Code Execution Vulnerability

Zerodayinitiative • September 9, 2026

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oracle Outside In Technology. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of WPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process.

Oracle has issued an update to correct this vulnerability. More details can be found at:

2026-04-08 - Vulnerability reported to vendor

2026-09-09 - Coordinated public release of advisory

2026-09-09 - Advisory Updated

Mat Powell of TrendAI Zero Day Initiative

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Remote Code Execution Vulnerabilities in Oracle Outside In Technology Oracle Outside In Technology has been found to have multiple vulnerabilities that allow remote attackers to execute arbitrary code. These vulnerabilities affect installations of the software and require user interaction, such as visiting a malicious page or opening a malicious file. The flaws include issues in parsing PostScript, GEM, WPS, and PDF files, leading to heap-based buffer overflows and integer overflows. Oracle has issued updates to address these vulnerabilities. The vulnerabilities are identified as ZDI-26-635, ZDI-26-636, ZDI-26-637, and ZDI-26-638. The vulnerabilities were reported to the vendor on 2026-04-08, and the advisories were publicly released on 2026-09-09. Security professionals are advised to apply the updates promptly to mitigate risks. 4 sources 61

Extracted Entities

ZDI-26-638: Oracle Outside In Technology WPS File Parsing Memory Corruption Remote Code Execution Vulnerability

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

Platforms (1)