Microsoft Onenote vulnerabilities

16 CVEs affecting Microsoft Onenote, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-26133, published 2026-03-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2007-0671: Microsoft Office Excel Remote Code Execution Vulnerability, published 2007-02-03. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-08-12. EPSS: 43.2% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack…
CVE-2004-0200, published 2004-09-28. High severity, CVSS 9.3. EPSS: 49% chance of exploitation in the next 30 days. Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with…
CVE-2014-2815, published 2014-08-12. High severity, CVSS 8.8. EPSS: 43.8% chance of exploitation in the next 30 days. Microsoft OneNote 2007 SP3 allows remote attackers to execute arbitrary code via a crafted OneNote file that triggers creation of an executable file in a startup folder, aka "OneNote Remote Code…
CVE-2016-3315, published 2016-08-09. Medium severity, CVSS 5.5. EPSS: 30.2% chance of exploitation in the next 30 days. Microsoft OneNote 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016, and 2016 for Mac allow remote attackers to obtain sensitive information via a crafted OneNote file, aka "Microsoft OneNote…
CVE-2017-0197, published 2017-04-12. High severity, CVSS 7.8. EPSS: 19.1% chance of exploitation in the next 30 days. Microsoft OneNote 2007 SP3 and Microsoft OneNote 2010 SP2 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office DLL Loading Vulnerability."
CVE-2017-8509, published 2017-06-15. High severity, CVSS 8.8. EPSS: 18.2% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique…
CVE-2008-3068, published 2008-07-07. High severity, CVSS 7.5. EPSS: 17.4% chance of exploitation in the next 30 days. Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a…
CVE-2015-2503, published 2015-11-11. High severity, CVSS 9.3. EPSS: 16.5% chance of exploitation in the next 30 days. Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2007 IME (Japanese)…
CVE-2006-3877, published 2006-10-10. High severity, CVSS 9.3. EPSS: 13.4% chance of exploitation in the next 30 days. Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office 2002, Office 2003, Office 2004 for Mac, and Office v.X for Mac allows user-assisted attackers to execute arbitrary code via an…
CVE-2023-33140, published 2023-06-14. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. Microsoft OneNote Spoofing Vulnerability

Latest

CVE-2026-26133, published 2026-03-16. High severity, CVSS 7.1. EPSS: 0.6% chance of exploitation in the next 30 days. AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2025-29822, published 2025-04-08. High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days. Incomplete list of disallowed inputs in Microsoft Office OneNote allows an unauthorized attacker to bypass a security feature locally.
CVE-2025-21402, published 2025-01-14. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. Microsoft Office OneNote Remote Code Execution Vulnerability
CVE-2024-41159, published 2024-12-18. High severity, CVSS 7.1. EPSS: 0.8% chance of exploitation in the next 30 days. A library injection vulnerability exists in Microsoft OneNote 16.83 for macOS. A specially crafted library can leverage OneNote's access privileges, leading to a permission bypass. A malicious…
CVE-2023-36769, published 2023-11-06. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Microsoft OneNote Spoofing Vulnerability
CVE-2023-21721, published 2023-02-14. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Microsoft OneNote Elevation of Privilege Vulnerability