CVE-2026-60413: Oracle Outside In GEM Parsing Integer Overflow (ZDI-26-637) — Detection and Remediation Guide

Zero Day Initiative has published ZDI-26-637, disclosing CVE-2026-60413 — an integer overflow in the GEM image file parser embedded in Oracle Outside In Technology (OIT). The flaw carries a CVSS score of 7.8 and allows remote attackers to achieve arbitrary code execution. Exploitation requires user interaction: the target must open a malicious file or visit a malicious page that triggers the vulnerable parser.

If you have never heard of Outside In, do not assume you are unaffected. OIT is not a product end users install — it is a document parsing and conversion SDK licensed and embedded into a long list of enterprise software: content management platforms, search indexers, email security gateways, DLP engines, eDiscovery tools, and Oracle's own WebCenter and Fusion Middleware stacks. That is precisely what makes this class of vulnerability dangerous: a single parser bug propagates silently into dozens of downstream products, and the exploit path is nothing more exotic than a user opening a file.

Defenders should treat this as a priority patching and detection-engineering item, particularly in environments where OIT-based parsing happens server-side with minimal user friction (automated ingestion pipelines, mail gateways, indexing services) — where 'user interaction required' can be satisfied by simply emailing a crafted file into the organization.

Technical Analysis

Vulnerability Overview

• CVE: CVE-2026-60413
• Advisory: ZDI-26-637
• CVSS: 7.8 (High) — consistent with a local-vector, user-interaction-required RCE (CVSS:3.1 AV:L/AC:L/PR:N/UI:R pattern typical of malicious-document bugs)
• Class: Integer overflow (CWE-190) leading to memory corruption during file parsing
• Component: GEM image file format parsing within Oracle Outside In Technology
• Attack requirement: Target must open a malicious file or visit a malicious page

How the Vulnerability Works (Defender's View)

The root cause is an integer overflow during GEM file parsing. In practical terms, the parser reads a length, dimension, or count field from the attacker-controlled GEM file, performs arithmetic on it without adequate bounds checking, and the resulting wrapped value causes an undersized heap allocation. Subsequent operations then write past the allocated buffer — a classic integer-overflow-to-heap-overflow chain — giving the attacker control over memory corruption primitives and, ultimately, execution flow in the context of the process hosting the parser.

Key characteristics defenders need to internalize:

1. The exploit travels inside a document. The delivery vehicle is a crafted .gem file. Delivery vectors include phishing attachments, malicious web pages that trigger preview/thumbnailing, or any automated pipeline that ingests user-supplied files.
2. Execution lands in the host process. OIT runs in-process or as a tightly coupled child of whatever product embedded it — an indexing service, a conversion daemon, a content server. Post-exploitation, you will see the host process behaving abnormally (crashing, spawning children, making outbound connections), not a process literally named 'Outside In.'
3. Unauthenticated. No credentials are needed; the only gate is getting the file parsed.
4. Server-side amplification. Many OIT integrations parse files automatically (attachment sandboxing that itself uses OIT, search indexing, thumbnail generation). In those paths, 'user interaction' reduces to 'send a file into the org.'

Affected Products and Exposure

Oracle Outside In Technology 8.5.x lines are the directly affected component. Because OIT is an OEM SDK, exposure extends to any product embedding the vulnerable GEM filter, including Oracle WebCenter Content, Oracle Fusion Middleware components, and third-party applications that licensed Outside In for file conversion and viewing. You cannot scope this by looking for 'Oracle Outside In' in your installed-programs list — you must inventory for the SDK's binary footprint (the vs*.dll/vs*.so filter libraries and scc*.exe/scc* utility binaries such as sccfi, sccex, and sccca that ship with OIT-based integrations).

Exploitation Status

As of publication, there is no confirmed in-the-wild exploitation and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. ZDI coordinated disclosure implies a patch path exists through Oracle's Critical Patch Update (CPU) program. Treat the absence of known exploitation as a window of opportunity, not reassurance: document-parsing integer overflows with public advisories historically attract reverse engineering of the patched diff within days to weeks, and n-day weaponization of parser bugs is a well-worn offensive tradecraft pattern.

Detection & Response

Detection strategy for a parser RCE centers on three observable behaviors: (1) suspicious GEM file artifacts appearing in user-writable or mail-handling locations, (2) anomalous child processes or crashes originating from OIT host processes, and (3) post-exploitation process lineage from document-handling services.

Sigma Rules

---
title: Suspicious GEM Image File Creation in User-Writable Locations
id: 3f8a2c91-7b4e-4d15-9a6c-2e1f8b3d5a7c
status: experimental
description: Detects creation of GEM image files in temporary, download, or mail-processing directories. GEM is a legacy format with virtually no legitimate modern business use; new .gem files in these paths are a strong delivery signal for CVE-2026-60413.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-637/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/01/13
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection_ext:
    TargetFilename|endswith: '.gem'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\Inetpub\'
      - '\ProgramData\Microsoft\Windows\INetCache\'
      - '\Windows\Temp\'
  condition: selection_ext and selection_path
falsepositives:
  - Rare legitimate GEM graphics workflows (legacy Ventura Publisher / digital archiving)
level: high
---
title: Oracle Outside In Host Process Spawning Suspicious Child Process
id: 9c4d7e12-3a8f-4b56-8d1e-5f2a9c7b4e6d
status: experimental
description: Detects Outside In Technology utility binaries or common OIT-embedding host processes spawning shells, script interpreters, or LOLBins — a hallmark of successful parser exploitation (CVE-2026-60413) where code execution lands inside the parsing process context.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-637/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/13
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\sccca.exe'
      - '\sccex.exe'
      - '\sccfi.exe'
      - '\sccvw.exe'
      - '\sccdu.exe'
      - '\vshtml.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - None expected — OIT conversion utilities do not legitimately spawn interpreters
level: critical
---
title: Document Parsing or Indexing Service Spawning Shell or Script Interpreter
id: 5b2e9f41-6c7d-4a83-bf19-8d4c1e6a3f72
status: experimental
description: Detects content management, search indexing, and mail processing services known to embed Oracle Outside In spawning command shells or script engines. Covers the server-side exploitation path of CVE-2026-60413 where automated parsing triggers the bug without direct user action.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-637/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/01/13
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Oracle\'
      - '\WebCenter\'
      - '\Middleware\'
    ParentImage|endswith:
      - '\searchindexer.exe'
      - '\w3wp.exe'
      - '\java.exe'
      - '\tomcat.exe'
      - '\soffice.bin'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  filter_java:
    CommandLine|contains:
      - 'tomcat'
      - 'weblogic'
      - 'startup'
  condition: selection_parent and selection_child and not filter_java
falsepositives:
  - Application server administrative restarts invoking scripts; tune filter_java to your environment
level: high

A note on tuning: the first rule is the highest-signal, lowest-noise of the three. GEM is a decades-old Atari-era graphics format — outside of niche digital-forensics labs and archival digitization shops, a .gem file landing in a Temp or Downloads folder should page someone.

KQL (Microsoft Sentinel / Defender)

This query hunts the exploitation chain end-to-end: GEM file delivery, anomalous child processes from OIT utility binaries, and shell spawns from document-handling services. Run it over a 14-day lookback to catch slow-burn intrusions.

// CVE-2026-60413 - Oracle Outside In GEM parser exploitation hunt
// Part 1: Suspicious .gem file artifacts in user-writable/mail paths
let GemFileEvents = DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FileName endswith ".gem"
| where FolderPath has_any ("Temp", "Downloads", "INetCache", "Inetpub", "Content.MSO", "Attachment")
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;
// Part 2: OIT utility binaries or doc-handling services spawning interpreters
let SuspiciousChildren = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("sccca.exe", "sccex.exe", "sccfi.exe", "sccvw.exe", "searchindexer.exe", "soffice.bin")
   or InitiatingProcessFolderPath has_any ("\\Oracle\\", "\\WebCenter\\", "\\Middleware\\")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessFolderPath, AccountName;
// Part 3: Correlate - devices with both a .gem artifact and a suspicious child process
GemFileEvents
| summarize GemFirstSeen = min(TimeGenerated), GemFiles = make_set(FileName) by DeviceName
| join kind=inner (
    SuspiciousChildren
    | summarize ChildFirstSeen = min(TimeGenerated), Spawned = make_set(FileName), CmdLines = make_set(ProcessCommandLine) by DeviceName
) on DeviceName
| where ChildFirstSeen between (GemFirstSeen .. GemFirstSeen + 2h)
| project DeviceName, GemFirstSeen, GemFiles, ChildFirstSeen, Spawned, CmdLines
| order by GemFirstSeen desc

Velociraptor VQL

Use this artifact to sweep the fleet for both the binary footprint of embedded Outside In deployments (scoping your exposure) and suspicious GEM artifacts (delivery evidence).

-- CVE-2026-60413: Inventory OIT footprint and hunt GEM file delivery artifacts
-- Part A: Locate Outside In utility binaries and vs* filter libraries
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
    'C:\\**\\scc*.exe',
    'C:\\**\\vs*.dll',
    '/opt/**/scc*',
    '/opt/**/libvs*.so',
    '/usr/local/**/scc*',
    '/usr/local/**/libvs*.so'
], accessor='auto')
WHERE FullPath !~ 'Backup|\\.old$'

-- Part B: Hunt for .gem files in delivery-oriented locations
LET gem_hunt = SELECT FullPath, Size, Mtime
FROM glob(globs=[
    'C:\\Users\\*\\Downloads\\**.gem',
    'C:\\Users\\*\\AppData\\Local\\Temp\\**.gem',
    'C:\\Windows\\Temp\\**.gem',
    '/tmp/**.gem',
    '/var/tmp/**.gem',
    '/var/spool/**.gem'
], accessor='auto')
SELECT * FROM gem_hunt

For live-state triage on a host where you suspect exploitation already occurred, pair the above with a process listing filtered to OIT hosts:

-- Triage: enumerate running OIT host processes and their network connections
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ 'scc|outside|inso'
   OR Exe =~ '(?i)oracle|webcenter|middleware'

Remediation / Verification Script

Use the following PowerShell to inventory the Outside In footprint across a Windows host, enumerate downstream products embedding it, and flag GEM files in high-risk locations. Run via your EDR's live response or as a scheduled GPO/Intune task during the remediation window.

# CVE-2026-60413 - Oracle Outside In GEM Parser Exposure Inventory & Triage
# Run elevated. Outputs CSV for fleet-wide aggregation.

$Report = @()
$OutCsv = "$env:ProgramData\OIT_CVE-2026-60413_Inventory_$(Get-Date -Format 'yyyyMMdd_HHmm').csv"

# 1) Locate Outside In binaries (scc* utilities and vs* filter libraries)
Write-Host '[*] Scanning for Oracle Outside In binary footprint...' -ForegroundColor Cyan
$SearchRoots = @('C:\Program Files','C:\Program Files (x86)','C:\Oracle','D:\','E:\') |
    Where-Object { Test-Path $_ }
foreach ($root in $SearchRoots) {
    Get-ChildItem -Path $root -Recurse -Include 'scc*.exe','vs*.dll' -ErrorAction SilentlyContinue |
        ForEach-Object {
            $vi = $_.VersionInfo
            $Report += [pscustomobject]@{
                FindingType  = 'OIT-Binary'
                Path         = $_.FullName
                Product      = $vi.ProductName
                FileVersion  = $vi.FileVersion
                Modified     = $_.LastWriteTime
                RiskNote     = 'Outside In component present - verify patched against CVE-2026-60413'
            }
        }
}

# 2) Flag GEM files in delivery-oriented paths
Write-Host '[*] Scanning for suspicious .gem artifacts...' -ForegroundColor Cyan
$GemPaths = @("$env:TEMP", 'C:\Windows\Temp')
Get-ChildItem 'C:\Users' -Directory -ErrorAction SilentlyContinue | ForEach-Object {
    $GemPaths += Join-Path $_.FullName 'Downloads'
}
foreach ($p in $GemPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Filter '*.gem' -ErrorAction SilentlyContinue |
            ForEach-Object {
                $Report += [pscustomobject]@{
                    FindingType  = 'GEM-Artifact'
                    Path         = $_.FullName
                    Product      = ''
                    FileVersion  = ''
                    Modified     = $_.LastWriteTime
                    RiskNote     = 'Suspicious GEM file - collect for analysis before deletion'
                }
            }
    }
}

# 3) Report
if ($Report.Count -eq 0) {
    Write-Host '[+] No Outside In footprint or GEM artifacts found on this host.' -ForegroundColor Green
} else {
    Write-Host "[!] $($Report.Count) finding(s). Exporting to $OutCsv" -ForegroundColor Yellow
    $Report | Export-Csv -Path $OutCsv -NoTypeInformation
    $Report | Format-Table -AutoSize
}

Remediation

1. Patch at the source. Apply the Oracle Critical Patch Update that remediates CVE-2026-60413 for Oracle Outside In Technology and any affected Oracle products (WebCenter Content, Fusion Middleware). Consult the Oracle CPU advisory and the ZDI advisory at http://www.zerodayinitiative.com/advisories/ZDI-26-637/ for the authoritative fixed-version mapping for your deployment.

2. Chase your OEM supply chain — this is the hard part. The Outside In SDK is embedded in third-party software (document viewers, mail gateways, DLP, eDiscovery, content services). Your Oracle CPU alone does not close the hole. Use the inventory script above (or equivalent EDR software-inventory queries) to find scc*/vs* binaries, identify the hosting product, and open vendor tickets demanding their patched OIT build. Track these as distinct remediation items per vendor — they will not all ship fixes on the same day.

3. Block GEM at the perimeter as a compensating control. GEM is a legacy Atari-era graphics format with near-zero legitimate modern business use. Add .gem to your email gateway attachment block list, web proxy file-type policies, and — where feasible — application control policies that prevent OIT host processes from spawning child processes. This kills the delivery vector while vendor patches are pending.

4. Harden parsing hosts. Where server-side products invoke OIT for automated conversion/indexing, ensure those services run under least-privilege service accounts, in sandboxed or containerized contexts where supported, and with outbound network egress restricted. A parser RCE with no egress and no child-process rights is a much smaller incident.

5. Enable crash telemetry on parsing services. Integer-overflow exploitation attempts — even failed ones — produce crashes in the hosting process during filter invocation. Configure WER/service crash alerting on identified OIT host processes and route those events to your SIEM. A burst of crashes in a conversion service after a mail flow event is a detection in itself.

6. Retrohunt. Pull proxy, mail gateway, and EDR file logs for .gem file transfers over the past 30 days. Anything found gets collected and analyzed before deletion — treat unknown-origin GEM files as potentially malicious until proven otherwise.

7. Timeline guidance. Although CVE-2026-60413 is not currently in CISA KEV and carries no federal remediation deadline, a CVSS 7.8 unauthenticated RCE in a ubiquitous OEM parser warrants expedited handling: perimeter block within 24–48 hours, Oracle CPU deployment within your normal critical-patch cycle (target ≤14 days), and OEM vendor patches tracked to closure. Do not let the 'user interaction required' caveat push this into the routine queue — for automated parsing pipelines, that caveat is operationally meaningless.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub