Microsoft Office OneNote Remote Code Execution Vulnerability

Summary

Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network. Published in October 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely.

Why it matters

Microsoft published this item through its Security Update Guide, making it part of Patch Tuesday triage for affected Windows, cloud, or application estates. EPSS percentile: 54%.

Operator check

Review the Microsoft Security Update Guide entry for CVE-2026-102858. Confirm whether Microsoft Office OneNote is deployed, then apply the current security update or documented mitigation. CVSS score: 8.8. EPSS probability: 0.7%; percentile: 54%.

Sources