Microsoft OneNote CVE-2026-96997

Requires the attacker to already have local, authenticated low-privilege access to a host running an affected Microsoft Office OneNote build (per EUVD: Office LTSC 2021 below 16.0.14334.20974, Office LTSC 2024 below 16.0.17932.21056, plus 365 Apps for Enterprise and the Mac/LTSC-for-Mac editions). Exploitation hinges on triggering a use-after-free in OneNote to gain code execution in a higher-privileged context; it is not remotely reachable (AV:L) and cannot be performed by an unauthenticated network attacker. Limiting factors: local access prerequisite, the PR:L authorization requirement, and the availability of a vendor patch - meaning fully updated installations are not exposed. No separate victim user interaction is required (UI:N).

This is a genuine patch-priority item but not an emergency. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a local, low-privilege, low-complexity use-after-free (CWE-416) with full confidentiality, integrity, and availability impact - a classic local elevation-of-privilege profile. The attacker must already be an authorized/authenticated local user (PR:L), which materially lowers urgency versus a remote unauthenticated flaw. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or imminent widespread exploitation: exploitation status is 'no public exploit identified at time of analysis.' Signals are internally consistent - the local vector and PR:L align with an EoP use case, and no conflicting remote-access language appears in the description. The main driver of real-world priority is the extreme deployment footprint of Microsoft Office/OneNote rather than ease or likelihood of exploitation; treat as a standard Patch-Tuesday-grade local EoP to remediate on the normal cycle, prioritized on multi-user or shared hosts where local EoP matters most.

A local authenticated user (or malware running in that user's context) opens or processes specially crafted OneNote content that triggers a use-after-free in Microsoft Office OneNote, corrupting memory to gain code execution at a higher privilege level. No user interaction by a separate victim is required (UI:N) and attack complexity is low (AC:L), but the attacker must already have local low-privilege access. No public proof-of-concept exploit is identified in the available data.