Microsoft 365 Apps: Use after free in OneNote allows local privilege escalation

Summary

Microsoft Office OneNote, part of Microsoft 365 Apps and Office LTSC editions, contains a use-after-free memory flaw (CWE-416). An authenticated local user with low privileges can exploit it to run code with elevated privileges, with high impact on confidentiality, integrity and availability. Exploitation requires local access and a valid low-privilege session, so it is most relevant as a second step after phishing, malicious documents or malware has gained a user session.

Affected

• Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build (CNA record, exact build not confirmed)
• Microsoft 365 Apps for Mac (Office 365 for Mac): 1.0.0 up to but excluding 16.114.26101123
• Office LTSC 2021: 16.0.1 up to but excluding 16.0.14334.20974
• Office LTSC 2024: 16.0.0 up to but excluding 16.0.17932.21056
• Office LTSC for Mac 2021 and 2024: 16.0.0 or 16.0.1 up to but excluding 16.114.26101123

Fixed in

• Microsoft 365 Apps for Mac and Office LTSC for Mac: 16.114.26101123 (October 14, 2026 release, per Microsoft release notes)
• Office LTSC 2021: 16.0.14334.20974 (per CNA record)
• Office LTSC 2024: 16.0.17932.21056 (per CNA record)
• Microsoft 365 Apps for Enterprise (Click-to-Run): October 2026 update; exact build unknown
• Verify all build numbers on the MSRC advisory page before relying on them.

Workaround

Unknown. Microsoft does not list a workaround; applying the security update is the fix.

Exploitation

• Not listed in the CISA KEV catalog
• CISA SSVC: exploitation none, automatable no, technical impact total
• EPSS below 1 percent (very low)
• No known exploits according to Nessus; no public proof of concept found in the research
• Local attack vector with low attack complexity, but requires low privileges

Our recommendation

• Deploy the October 2026 Office update via Microsoft 365 update channel, WSUS or Intune, and verify OneNote versions on Windows and Mac.
• Prioritise shared and unmanaged endpoints.
• Plan migration off Office LTSC 2021 (support ends October 13, 2026) and Office 2019 (out of support), as they will not receive fixes.
• Limit local administrator rights, restrict macros and untrusted files, and keep endpoint protection active.
• Confirm fixed builds against the MSRC advisory.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96997 msrc.microsoft.com
• OpenCVE: CVE-2026-96997 app.opencve.io
• Microsoft Learn: Office for Mac release notes learn.microsoft.com
• Tenable Nessus plugin 365619 www.tenable.com
• Office Watch: October 2026 Patch Tuesday Office fixes office-watch.com
• Robert365: Latest updates for classic Outlook robert365.com
• Vulners: CVE-2026-96997 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:32.