CVE-2026-97781

Summary

Microsoft Office OneNote is vulnerable to command injection when processing specially crafted input, allowing remote attackers to execute arbitrary code on affected systems. This represents a significant security risk as OneNote is widely used across Microsoft 365 environments.

Exploitability

Exploitation requires a remote attacker to convince a user to open a malicious OneNote file or document, making it moderately difficult but achievable through social engineering or phishing campaigns.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on user workstations with the privileges of the logged-in user, potentially leading to full system compromise or lateral movement within the organization.

Detection

Monitor for unusual process execution patterns involving 'onenote.exe' with command-line arguments that contain special shell characters or external command invocations, particularly when these processes are initiated by user accounts during normal office hours.

Prioritized remediation

Deploy Microsoft's security update KB5042378 immediately, which addresses this command injection vulnerability in OneNote.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.