Microsoft OneNote EUVD-2026-100460

Exploitation requires a victim to open an attacker-crafted OneNote document in Microsoft Office OneNote (UI:R); it cannot fire without that user interaction, which is the primary limiting factor. No authentication is required of the attacker (PR:N), and no special victim-side configuration is implied by the description - the flaw is in OneNote's handling/neutralization of special elements in content, so default installations that open the malicious file are affected. The practical constraint is social-engineering success in getting the target to open the file rather than any non-default feature or elevated privilege.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk inflation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity, unauthenticated code execution with full confidentiality, integrity, and availability impact - the only meaningful brake is the required user interaction (UI:R), typical of a client-side Office attack where a victim must open a crafted OneNote document. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided, so exploitation-likelihood signals are entirely absent and cannot be used to raise or lower the assessment: exploitation status is therefore 'no public exploit identified at time of analysis.' There is a mild tension worth verifying: command injection (CWE-77) in a document-rendering client is plausibly network-delivered via a malicious file but requires the user to open it, which the UI:R flag correctly captures - the AV:N rating reflects delivery over a network (e.g. email/web link) rather than direct network service exposure, so this is a phishing-style vector, not a wormable server flaw. Priority should be high for patching but the absence of any exploitation telemetry means it is not yet confirmed as actively targeted.

An attacker crafts a malicious OneNote document (or notebook content) that embeds a command-injection payload and delivers it to a victim via email or a web link. When the victim opens the file in Microsoft Office OneNote, the special elements are improperly neutralized and attacker-chosen commands execute in the user's context. No public exploit code was identified in the provided data.