Vulnerability Spotlight: Multiple Code Execution Vulnerabilities in Oracle Outside In Technology

Summary: Cisco Talos researcher Aleksandar Nikolic found multiple code execution vulnerabilities in Oracle Outside In Technology, including a PDF flaw where an exclamation point in the /Index entry causes a string pointer to be used where an integer is expected, and a controlled /Size parameter yields an arbitrary pointer. A second flaw in the RTF parser causes memory to be freed when \par is processed and then reused without reallocation when \footer is processed, allowing an attacker who manipulates that memory region to execute arbitrary code.
Why it matters: Both flaws end in arbitrary code execution on affected systems, and Outside In Technology is a parsing library embedded in other vendors' products, so the reach of a single malformed PDF or RTF file extends well beyond Oracle's own install base.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026