CVE-2026-102858
HighCVSS 8.8Summary
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
Risk Assessment
An attacker can remotely execute arbitrary code in the context of the user opening a malicious OneNote file, potentially leading to full workstation compromise.
Recommendation
Apply the latest Microsoft Office security updates for OneNote as soon as possible and avoid opening files from untrusted sources.
Other vulnerabilities in Microsoft Office OneNote
See all- CVE-2026-97781High
Command injection vulnerability in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
- CVE-2026-96997High
Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally.
- CVE-2025-21402High
A vulnerability in Microsoft Office OneNote allows for remote code execution. An attacker can exploit this flaw to execute malicious code on the victim's system.
- CVE-2026-55133High
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code locally. The attack requires local access.
- CVE-2024-21384High
Vulnerability in Microsoft Office OneNote allows remote code execution. An attacker could exploit this flaw to run malicious code on the victim's machine.
Original NVD description (English source)
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS