EUVD-2026-99041
GHSA-r6w3-7r2g-5962
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious OneNote file via phishing
-
DeliveryVictim opens crafted document
-
ExploitTrigger heap buffer overflow in parser
-
ExecutionExecute arbitrary code as user
-
ImpactCompromise host in user context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or preview an attacker-crafted OneNote/Office document that triggers the heap overflow (UI:R in the CVSS vector) - it is not zero-click. Per PR:N the attacker needs no prior authentication to the target, and per AV:N delivery can be fully remote (email, web, file share). The principal limiting factors are the mandatory user interaction and the fact that code executes in the opening user's security context (S:U, no scope change / no inherent privilege escalation). No special server configuration is required beyond a standard OneNote/Office installation capable of opening the malicious file. |
| Impact | CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity code execution requiring no privileges but mandatory user interaction (UI:R) - the classic Office client-side file-open pattern. The CWE-122 heap-based buffer overflow combined with C:H/I:H/A:H implies full compromise of the user's security context upon successful exploitation. However, the exploitation signals are weak-to-absent: there is no public exploit identified at time of analysis (no POC), no CISA KEV listing, and no EPSS probability supplied in the input, so there is no evidence of active or imminent exploitation. The gating factor is UI:R - a victim must open or preview a malicious OneNote/Office document - which lowers real-world risk relative to a true zero-click RCE. This is a genuine priority to patch given the ubiquity of Office and Microsoft's history of client-side document RCE being weaponized post-disclosure, but as of this analysis it is a high-severity-but-no-observed-exploitation issue rather than a confirmed active threat. Note: EPSS and KEV data were not present in the input and cannot be compared; absence is not a negative signal, merely missing. |
| Exploit ScenarioDerived | An attacker crafts a malicious OneNote (or embedded Office) file containing data that triggers a heap-based buffer overflow when parsed, then delivers it via phishing email or a hosted link. When the targeted user opens or previews the file, the overflow corrupts heap memory and executes attacker-controlled code in the user's context. No public proof-of-concept was identified at time of analysis, and exploitation is gated by the required user interaction (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Heap-based buffer overflow in Microsoft OneNote allows unauthenticated remote attackers to execute arbitrary code in the security context of the user who opens a crafted OneNote file, rated CVSS 3.1 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Exploitation is not zero-click: per the UI:R component of the assessed vector, the victim must open or preview an attacker-supplied OneNote/Office document delivered by email, web, or file share, and code then runs with that user's privileges without scope change (S:U), so no inherent privilege escalation is provided. No public exploit identified at time of analysis and the CVE is not in CISA KEV; no EPSS score was supplied in the available data.
RemediationAI
Primary action is to apply Microsoft's fix for CVE-2026-102858 as published in the vendor security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102858 - Patch available per vendor advisory; the feed did not enumerate an exact patched build number, so obtain the required build level from that MSRC page and deploy it through your normal Office update channel (Microsoft Update, Click-to-Run/ODT, or Windows Update), then confirm the installed build matches Microsoft's fixed version. Until endpoints are patched, the mandatory UI:R precondition is the main control point: block or quarantine .one, .onetoc2, and related OneNote attachment types at the email gateway and web/proxy layers, and warn users not to open OneNote files from unverified senders - the trade-off is that legitimate OneNote sharing is disrupted, so pair this with an exception process for known internal senders. Force untrusted Office/OneNote content through Protected View and Application Guard, which prevents rendering until the user explicitly opts in and substantially reduces exposure, at the cost of an extra prompt and degraded convenience for documents that genuinely need editing. Enforce Microsoft Defender for Office 365 Safe Attachments or an equivalent detonation sandbox for OneNote-bearing mail, and where available enable Office/Attack Surface Reduction rules that block Office child-process creation, accepting occasional false positives against legitimate macros or add-ins. Finally, run OneNote with least privilege and keep EMET-like/exploit-protection mitigations (heap integrity, CFG, DEP/ASLR) enabled so that a successful heap overflow is harder to convert into reliable code execution.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a heap-based buffer overflow (CWE-122) in the code path Microsoft OneNote uses to parse/load document content, meaning a miscalculated allocation or length check causes writes beyond an allocated heap buffer, corrupting adjacent heap metadata or objects. Heap corruption of this class is commonly leveraged to hijack an indirect call or overwrite a function pointer, converting a pure memory-safety bug into reliable code execution in the opening process. The assessed CVSS vector clarifies the threat model: network delivery is possible (AV:N) with low attack complexity (AC:L) and no attacker authentication (PR:N), but the trigger is a client-side file-open action (UI:R), execution is confined to the user's context with no scope change (S:U), and confidentiality, integrity, and availability are all rated High. Practically, the malicious content is likely embedded in a .one section file, an embedded preview, or a document that OneNote parses, and the exploitation surface is any standard installation of the affected Office/OneNote build capable of rendering such a file; no special server-side configuration or elevated target privileges are required beyond the user opening the file. No CPE strings or additional library/protocol details were provided in the intelligence feed, so the exact vulnerable build range should be confirmed against the Microsoft advisory.
Know when Microsoft 365 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-based client RCE: remotely deliverable (AV:N), reliable parsing bug (AC:L), no auth needed (PR:N) but victim must open the file (UI:R), executing in user context with full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft OneNote is affected by a high-severity heap-based buffer overflow (CVE-2026-102858) that allows unauthenticated remote code execution when a user opens a crafted file. Successful exploitation grants the attacker the same privileges as the victim, potentially leading to data theft or lateral movement. With no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, leadership should prioritize interim mitigations to protect users who frequently handle OneNote documents.
Disable OneNote preview in email clients and web browsers, block OneNote file attachments at the email gateway, enforce application allowlisting, restrict execution of OneNote via WDAC/AppLocker, and educate users to avoid opening untrusted OneNote files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Microsoft 365
View allHeap-based buffer overflow in Microsoft Office Word enables local code execution with full user-level impact when a vict
Heap-based buffer overflow in Microsoft Office Word enables arbitrary local code execution when a user opens a specially
Stack-based buffer overflow in Microsoft Office Word enables local arbitrary code execution when a user opens a maliciou
Use-after-free memory corruption in Microsoft Office Word enables local code execution when a user opens a specially cra
Heap-based buffer overflow in Microsoft Office Word enables local code execution with High confidentiality, integrity, a
Code execution via buffer over-read in Microsoft Office Word affects multiple Windows and Mac Office product lines when
Stack-based buffer overflow in Microsoft Office Word enables arbitrary code execution when a victim opens a specially cr
Remote code execution in Microsoft Office Outlook stems from a heap-based buffer overflow (CWE-122) that lets an unauthe
Heap-based buffer overflow in Microsoft Outlook allows an unauthenticated remote attacker to execute code over a network
Remote code execution affects Microsoft Outlook through a stack-based buffer overflow (CWE-121) that a remote attacker c
Remote code execution in Microsoft PowerPoint allows unauthenticated attackers to execute arbitrary code with the privil
Heap-based buffer overflow in Microsoft Office allows unauthenticated remote attackers to execute arbitrary code on a vi
Exploit-DB