CVE-2026-97781
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
Command injection vulnerability in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
Risk Assessment
An attacker could remotely execute arbitrary code in the user's context, potentially leading to system compromise or data theft.
Recommendation
Install the latest security updates for Microsoft Office OneNote and restrict access from untrusted networks.
Other vulnerabilities in Microsoft Office OneNote
See all- CVE-2025-21402High
A vulnerability in Microsoft Office OneNote allows for remote code execution. An attacker can exploit this flaw to execute malicious code on the victim's system.
- CVE-2026-96997High
Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally.
- CVE-2026-102858High
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
- CVE-2026-55133High
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code locally. The attack requires local access.
- CVE-2024-21384High
Vulnerability in Microsoft Office OneNote allows remote code execution. An attacker could exploit this flaw to run malicious code on the victim's machine.
Original NVD description (English source)
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS