Microsoft Office OneNote: Heap-based buffer overflow allows remote code execution
Summary
A heap-based buffer overflow in Microsoft Office OneNote, part of Microsoft 365 Apps, can be exploited by an unauthorized attacker over a network. The attacker can execute code on the affected system (CVSS 8.8, high). Exploitation requires that a user takes an action, such as opening a crafted OneNote file received by email or as an attachment.
Affected
- Microsoft 365 Apps for Mac: 1.0.0 to before 16.114.26101123
- Office LTSC for Mac 2021: 16.0.1 to before 16.114.26101123
- Office LTSC for Mac 2024: 16.0.0 to before 16.114.26101123
Fixed in
- Fixed in the October 2026 Office for Mac update (build 16.114.26101123 or later, per the CVE record).
- Exact fixed builds for Windows Office clients: Unknown. Check the MSRC advisory.
Workaround
Unknown. No vendor-published workaround found. Apply the update.
Exploitation
- Exploited in the wild: No evidence found. Verify against the CISA KEV catalog.
- Public proof of concept: No reliable evidence found.
- CISA SSVC: Exploitation none, automatable no, technical impact total.
Our recommendation
- Deploy the October 2026 Office updates to all Microsoft 365 Office clients, including Mac, as a priority.
- Check the MSRC advisory for exact fixed builds and verify installed versions.
- Check the CISA KEV catalog for changes in exploitation status.
- Train users not to open unsolicited OneNote files or attachments and filter malicious mail attachments.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide (MSRC) msrc.microsoft.com
- NVD/Vulners record vulners.com
- Microsoft Office security updates learn.microsoft.com
- Microsoft Office for Mac release notes learn.microsoft.com
- Qualys October 2026 Patch Tuesday review blog.qualys.com
- strix.ai CVE page www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:26.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.