Oracle OIT Image Export SDK libvs_pdf XRef Index Code Execution Vulnerability

Summary: Talos discovered a heap overflow vulnerability in Oracle's Outside In Technology Image Export SDK, located in the sub_B74EB0EE function of libvs_pdf.so, where a malformed PDF with many objects specified in the /Index entry causes a memory overwrite past the allocated buffer and overwrites adjacent heap chunks. A minimized test case with /Size of 6 but an /Index referencing 20 objects starting at object number 40 triggers heap corruption and a function pointer overwrite that is later dereferenced, giving direct program counter control; Oracle released a patched version of the SDK on April 19, 2016.
Why it matters: This is arbitrary code execution reachable by opening a crafted PDF, and the overwritten function pointer hands an attacker direct control of the program counter - the same parsing code sits inside Oracle's SDK, so every product that embeds it inherits the exposure.

Read the original at Cisco Talos ↗

Topics: Malware
Related: ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026
Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026
Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026