CVE-2026-102858: Microsoft Office OneNote Remote Code Execution Vulnerability

Vulnerability Overview and Official Status Metrics​

At the core of CVE-2026-102858 is the official vulnerability description: "Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network." While the network attack vector (AV:N) might initially sound like a wormable, zero-click service flaw, Microsoft's official advisory clarifies the exact mechanics of the threat.

Below are the complete technical parameters and status indicators recorded by the MSRC for this advisory:

• CVE ID: CVE-2026-102858
• Title: Microsoft Office OneNote Remote Code Execution Vulnerability
• Severity: Important
• CVSS Base Score: 8.8
• CVSS Temporal Score: 7.7
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness Enumeration: CWE-122
• Exploitation Assessment: Exploitation Unlikely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Deconstructing the Attack Vector and User Interaction​

Why does a file-based vulnerability carry a Network (AV:N) designation in its CVSS v3.1 vector string? Based on general industry standards for CVSS scoring and Microsoft's official advisory FAQ, vulnerabilities triggered by files delivered over the internet—such as email attachments or web downloads—are classified under the network vector because the malicious payload does not require the attacker to have local login access to the target machine.

However, Microsoft's official advisory explicitly addresses the operational boundaries of this flaw:

• Target Context and User Interaction: According to the CVSS metric, the attack vector is network (AV:N) and user interaction is required (UI:R). When answering what the target context of the remote code execution is, the advisory confirms that this attack requires a user to open a specially crafted file from the attacker to initiate remote code execution.
• Preview Pane Assessment: A critical question for enterprise messaging and desktop security teams is whether simply viewing an incoming message or highlighting a file in a file manager can trigger the overflow. On the question of whether the Preview Pane is an attack vector for this vulnerability, Microsoft states: "No, the Preview Pane is not an attack vector."

From a practical security standpoint, the absence of Preview Pane exposure significantly lowers the immediate risk of drive-by compromise inside email clients. An unauthenticated attacker (PR:N) benefits from low attack complexity (AC:L), and a successful exploit within the unchanged scope (S:U) of the user's session delivers high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). Because CWE-122 involves overwriting dynamically allocated heap memory when parsing malformed document structures, opening a malicious file could allow arbitrary code execution with the privileges of the logged-in user. Still, Microsoft assesses the flaw as Exploitation Unlikely, with unproven exploit maturity (E:U), an official fix available (RL:O), and confirmed report confidence (RC:C).

Section Summary: CVE-2026-102858 is a high-scoring (8.8 base, 7.7 temporal) heap-based buffer overflow (CWE-122) in OneNote, but it cannot be triggered silently via the Preview Pane. An attacker must convince a user to actively open a specially crafted file.

Affected Products, Fixed Builds, and Remediation​

In modern enterprise environments, Windows administrators frequently govern macOS productivity deployments alongside Windows endpoints. Microsoft's official advisory confirms that security updates are available and must be installed to protect affected systems. Specifically, addressing whether the updates for Microsoft Office LTSC for Mac 2021 and 2024 are currently available, the advisory notes: "Yes. As of October 15, 2025, the security update for Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac are available. Customers running Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac should ensure the update is installed to be protected from this vulnerability." (Note: While the CVE record was published on October 15, 2026, the MSRC advisory FAQ text contains the verbatim date string "October 15, 2025".)

Unlike Windows Office patches that sometimes map to individual Knowledge Base (KB) numbers, the KB field for these three macOS offerings is empty in the MSRC metadata, pointing directly to the Microsoft Learn Office for Mac release notes and unified fixed build 16.114.26101123.

To ensure full compliance across your environment, follow the exact remediation actions specified by Microsoft:

1. For Microsoft Office 365 for Mac, update to fixed build 16.114.26101123 or later.
2. For Microsoft Office LTSC for Mac 2021, update to fixed build 16.114.26101123 or later.
3. For Microsoft Office LTSC for Mac 2024, update to fixed build 16.114.26101123 or later.

Practical Guidance for Cross-Platform IT Administrators​

Based on general industry knowledge of enterprise patch management, organizations managing both Windows and Mac fleets should verify that Microsoft AutoUpdate (MAU) policies or mobile device management (MDM) profiles are actively pushing build 16.114.26101123 or later across all three affected Office for Mac channels. Because the vulnerability requires a user to open a specially crafted file, standard defense-in-depth practices—such as blocking untrusted file attachments at the mail gateway and reminding staff not to open unexpected notebooks from external senders—provide valuable secondary protection while updates roll out.

Section Summary: Because Customer action required: Yes is set for CVE-2026-102858, administrators and end users running Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, or Microsoft Office LTSC for Mac 2024 should promptly update their installations to fixed build 16.114.26101123 or later to eliminate the heap-based buffer overflow risk.