CVE-2026-97781: Microsoft Office OneNote Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
Other sources
Microsoft Office OneNote Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases
Event History
Frequently Asked Questions
What interaction is required for exploitation?
The attacker must cause user interaction. The vulnerability is remotely reachable over a network and does not require attacker privileges, but the supplied data does not specify the exact action the user must take.
What level of impact could successful exploitation have?
Successful exploitation could allow code execution and has high confidentiality, integrity, and availability impact. The vulnerability is rated high severity with a CVSS score of 8.8.