Microsoft Onenote
16 CVEs affecting Microsoft Onenote. Latest disclosed: 2026-03-16. Critical: 0, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-8509 | High | 8.8 | 2017-06-15 | A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Executio… |
CVE-2014-2815 | High | 8.8 | 2014-08-12 | Microsoft OneNote 2007 SP3 allows remote attackers to execute arbitrary code via a crafted OneNote file that triggers creation of an executable file in a start… |
CVE-2007-0671 | High | 8.8 | 2007-02-03 | Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to exe… |
CVE-2025-29822 | High | 7.8 | 2025-04-08 | Incomplete list of disallowed inputs in Microsoft Office OneNote allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-21402 | High | 7.8 | 2025-01-14 | Microsoft Office OneNote Remote Code Execution Vulnerability |
CVE-2017-0197 | High | 7.8 | 2017-04-12 | Microsoft OneNote 2007 SP3 and Microsoft OneNote 2010 SP2 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office DLL Lo… |
CVE-2026-26133 | High | 7.1 | 2026-03-16 | AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
CVE-2024-41159 | High | 7.1 | 2024-12-18 | A library injection vulnerability exists in Microsoft OneNote 16.83 for macOS. A specially crafted library can leverage OneNote's access privileges, leading to… |
CVE-2023-33140 | Medium | 6.5 | 2023-06-14 | Microsoft OneNote Spoofing Vulnerability |
CVE-2023-21721 | Medium | 6.5 | 2023-02-14 | Microsoft OneNote Elevation of Privilege Vulnerability |
CVE-2016-3315 | Medium | 5.5 | 2016-08-09 | Microsoft OneNote 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016, and 2016 for Mac allow remote attackers to obtain sensitive information via a crafted OneNot… |
CVE-2023-36769 | Medium | 4.6 | 2023-11-06 | Microsoft OneNote Spoofing Vulnerability |
CVE-2015-2503 | | 2015-11-11 | Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word… | |
CVE-2008-3068 | | 2008-07-07 | Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by… | |
CVE-2006-3877 | | 2006-10-10 | Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office 2002, Office 2003, Office 2004 for Mac, and Office v.X for Mac allows user-assisted at… | |
CVE-2004-0200 | | 2004-09-28 | Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execu… |