Microsoft Office OneNote Remote Code Execution Vulnerability (CVE‑2026‑102858)

What happened

A heap‑based buffer overflow exists in Microsoft Office OneNote. An attacker can supply a malicious payload via a network connection or a crafted OneNote file, causing the application to execute arbitrary code on the victim’s machine.

Impact

Any user running a vulnerable OneNote instance is at risk. The flaw can lead to full remote code execution, enabling privilege escalation, data exfiltration, or persistence on the target system.

Mitigation

• Install the latest Office security update that addresses CVE‑2026‑102858.
• Disable network access to OneNote if the service is not required.
• Apply the principle of least privilege for accounts that run Office applications.

Detection

Watch for unexpected OneNote process activity, elevated privileges, or anomalous network traffic originating from the OneNote executable. Use endpoint detection and response (EDR) to flag suspicious behavior.