{"id":"CVE-2026-96997","state":"PUBLISHED","title":"Microsoft Office OneNote Elevation of Privilege Vulnerability","description":"Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally.","publishedAt":"2026-10-13T19:00:36.393Z","updatedAt":"2026-10-30T19:08:44.010Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft Microsoft 365 Apps for Enterprise","Microsoft Microsoft Office 365 for Mac","Microsoft Microsoft Office LTSC 2021","Microsoft Microsoft Office LTSC 2024","Microsoft Microsoft Office LTSC for Mac 2021","Microsoft Microsoft Office LTSC for Mac 2024"],"affected":[{"vendor":"Microsoft","product":"Microsoft 365 Apps for Enterprise","versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office 365 for Mac","versions":[{"version":"1.0.0","status":"affected","lessThan":"16.114.26101123","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2021","versions":[{"version":"16.0.1","status":"affected","lessThan":"16.0.14334.20974","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2024","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.17932.21056","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC for Mac 2021","versions":[{"version":"16.0.1","status":"affected","lessThan":"16.114.26101123","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC for Mac 2024","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.114.26101123","versionType":"custom"}]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96997"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-30T19:36:04.418Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/96xxx/CVE-2026-96997.json","commit":"a3048093a4809ba3e15db7a610bbd66f60b789d3","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-96997","state":"PUBLISHED","datePublished":"2026-10-13T19:00:36.393Z","dateUpdated":"2026-10-30T19:08:44.010Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2026-09-23T20:52:28.737Z"},"containers":{"cna":{"title":"Microsoft Office OneNote Elevation of Privilege Vulnerability","descriptions":[{"lang":"en-US","value":"Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally."}],"affected":[{"vendor":"Microsoft","product":"Microsoft 365 Apps for Enterprise","versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office 365 for Mac","versions":[{"version":"1.0.0","status":"affected","lessThan":"16.114.26101123","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2021","versions":[{"version":"16.0.1","status":"affected","lessThan":"16.0.14334.20974","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2024","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.17932.21056","versionType":"custom"}],"platforms":["32-bit Systems","x64-based Systems"]},{"vendor":"Microsoft","product":"Microsoft Office LTSC for Mac 2021","versions":[{"version":"16.0.1","status":"affected","lessThan":"16.114.26101123","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC for Mac 2024","versions":[{"version":"16.0.0","status":"affected","lessThan":"16.114.26101123","versionType":"custom"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96997","name":"Microsoft Office OneNote Elevation of Privilege Vulnerability","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":7.8,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","description":"CWE-416: Use After Free","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2026-10-30T19:08:44.010Z"},"datePublic":"2026-10-13T14:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"16.0.14334.20974"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.0.17932.21056"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"16.114.26101123"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.114.26101123"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"16.114.26101123"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-96997","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-13T19:37:37.938553Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-13T19:41:47.022Z"}}]}}}