CVE-2026-97781
8.8HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-77
Impact
Remote attackers can execute arbitrary code with the user's permissions when a user interacts with a malicious OneNote file or link. They do not need prior authentication, but user interaction is required.
Root cause
Improper neutralization of special elements enables command injection in Microsoft Office OneNote.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Apply the security update referenced in the Microsoft MSRC advisory (CVE-2026-97781). Block untrusted OneNote (.one, .onetoc2) file attachments at the email gateway if immediate patching is not possible.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.