CVE-2026-96997 in OneNote
Summary
by MITRE • 10/15/2026
Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability described involves a use-after-free error within the Microsoft Office OneNote application, which presents a significant risk for local privilege escalation when exploited by an authenticated user. This class of memory corruption flaw occurs when software continues to use a pointer after it has been freed from its allocated memory block. In the context of OneNote, this typically arises during the processing of complex document structures or specific file formats where memory management logic fails to properly invalidate pointers before deallocation. When an attacker crafts a maliciously constructed OneNote file containing specially designed objects and metadata, they can trigger conditions that cause the application to free certain data structures while retaining references to them in other parts of its internal state.
Upon subsequent operations such as rendering or parsing these malformed elements, the application attempts to access memory through these dangling pointers. Because modern operating systems do not immediately overwrite freed memory, an attacker who controls the allocation patterns can often reallocate that same memory region with controlled data structures. This allows the attacker to inject arbitrary code or manipulate function pointers within the process space of OneNote. By carefully crafting the payload to exploit specific heap layout behaviors and timing conditions inherent in the vulnerability, the malicious code gains execution control over the context in which OneNote is running.
The operational impact of this flaw is severe due to its potential for privilege escalation. Since Microsoft Office applications typically run with the privileges of the currently logged-in user, successful exploitation allows an attacker who has already gained access to a victim's account or can trick them into opening a malicious file to execute code within that same security context. If the targeted user possesses administrative rights on the local system, this vulnerability enables the attacker to take full control of the affected computer. This facilitates further lateral movement within a network, persistence through installed services or scheduled tasks, and access to sensitive data stored locally or accessible via mapped drives. The attack vector is primarily remote code execution leading to privilege escalation if social engineering succeeds in getting a user to open the crafted file, though it can also be triggered by automated processes that process OneNote files without strict sandboxing.
Mitigation strategies for this vulnerability rely heavily on timely patch management and defense-in-depth principles. Organizations should immediately apply the latest security updates provided by Microsoft for all versions of Office affected by this issue. These patches typically include fixes to the memory management routines within OneNote, ensuring that pointers are properly nullified after deallocation or preventing access to freed memory entirely. In environments where immediate patching is not feasible due to compatibility concerns, network segmentation can help isolate systems running vulnerable software from untrusted networks. Additionally, implementing application control policies such as Microsoft AppLocker or Windows Defender Application Control can restrict the execution of unauthorized scripts and binaries, thereby limiting the impact even if an initial exploit succeeds in gaining code execution within OneNote's process space.
From a classification perspective, this vulnerability aligns with CWE-416, Use After Free, which describes situations where software uses memory after it has been freed, leading to unpredictable behavior or security vulnerabilities. The exploitation technique maps closely to MITRE ATT&CK techniques related to privilege escalation and defense evasion, specifically those involving binary patching or heap spraying methods used to achieve arbitrary code execution in a higher-privileged context. Security teams should monitor for indicators of compromise associated with this specific memory corruption pattern, including unusual process creation events following the opening of OneNote files and attempts to spawn elevated shells from Office processes. Continuous monitoring and strict enforcement of least privilege principles remain critical defenses against such exploitation attempts.