CVE-2024-21384: Microsoft 365 Apps RCE Vulnerability

CVE-2024-21384 Overview

CVE-2024-21384 is a remote code execution vulnerability in Microsoft Office OneNote. The flaw affects Microsoft 365 Apps and Microsoft Office Long Term Servicing Channel 2021. Microsoft classified the issue as a use-after-free defect [CWE-416] in OneNote document handling. Successful exploitation requires user interaction to open a crafted OneNote file. The attack executes locally in the context of the current user, allowing code execution, data modification, and disruption of application availability.

Critical Impact
An attacker who convinces a user to open a malicious OneNote file can execute arbitrary code with the victim's privileges, compromising confidentiality, integrity, and availability.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Office Long Term Servicing Channel 2021
OneNote component within the above Office distributions

Discovery Timeline

2024-02-13 - CVE-2024-21384 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2024-21384

Vulnerability Analysis

The vulnerability is a use-after-free condition in Microsoft OneNote. OneNote processes structured section, page, and embedded object data when opening .one and .onepkg files. A crafted document triggers the reuse of memory after it has been freed. Attackers can leverage this dangling reference to hijack control flow and execute arbitrary code.

Exploitation is local and user-assisted. The victim must open the attacker-supplied file, typically delivered through email attachments, cloud sharing links, or removable media. Because OneNote documents are often trusted in enterprise workflows, adversaries frequently use them as a delivery vector to bypass mail filters that scrutinize macro-enabled Office files.

The EPSS probability is 0.849% with a percentile of 54.76, indicating moderate exploitation likelihood relative to other published CVEs. Microsoft has not identified public exploit code, and CISA has not added the CVE to the Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper management of object lifetimes inside OneNote's document parsing routines. When a crafted file forces the application to release an object while another code path still holds a pointer to it, subsequent access dereferences freed memory. This use-after-free primitive [CWE-416] can be shaped into arbitrary read, write, or control-flow hijack, depending on heap layout.

Attack Vector

The attacker prepares a malicious OneNote file and delivers it to the victim through phishing or social engineering. Opening the file in a vulnerable OneNote client triggers the use-after-free during parsing. Code executes at the privilege level of the logged-on user. No elevated privileges are required to launch the attack, and there is no network component. Attackers commonly chain this with local privilege escalation flaws when broader system compromise is the objective. See the Microsoft Security Update Guide for CVE-2024-21384 for vendor details.

Detection Methods for CVE-2024-21384

Indicators of Compromise

Unexpected child processes spawned from ONENOTE.EXE, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
OneNote files (.one, .onepkg) arriving from external senders and opened shortly before anomalous process activity
Crash dumps or Windows Error Reporting entries referencing OneNote memory access violations
Outbound network connections initiated by ONENOTE.EXE to previously unseen domains or IPs

Detection Strategies

Monitor process ancestry for ONENOTE.EXE spawning script interpreters or LOLBins
Alert on OneNote writing executable content (.exe, .dll, .hta, .js) to disk
Inspect email gateways for OneNote attachments containing embedded scripts or unusual file structures
Correlate Office telemetry with endpoint identifications of injection, credential access, or persistence activity

Monitoring Recommendations

Enable and forward Microsoft Defender for Office 365 and Windows Event Log data covering Office application launches
Ingest Sysmon Event ID 1 (process create) and Event ID 11 (file create) to a central SIEM for hunting
Track patch state of Microsoft 365 Apps and Office LTSC 2021 clients through configuration management tools
Review DNS and proxy logs for anomalous egress from user workstations following OneNote activity

How to Mitigate CVE-2024-21384

Immediate Actions Required

Apply the February 2024 security update from Microsoft to all Microsoft 365 Apps and Office LTSC 2021 installations
Confirm automatic updates are enabled and channels are current using the Office Deployment Tool or Intune
Restrict opening OneNote files received from untrusted external sources until patching is verified
Educate users on the risk of opening unsolicited .one and .onepkg attachments

Patch Information

Microsoft released a fix for CVE-2024-21384 as part of the February 2024 security update cycle. Refer to the Microsoft Security Update Guide for CVE-2024-21384 for the exact build numbers per channel. Enterprises should validate deployment coverage across Current Channel, Monthly Enterprise Channel, and Semi-Annual Enterprise Channel installations, as well as Office LTSC 2021 instances.

Workarounds

Block OneNote file types at the email gateway when business processes do not require them
Configure Attack Surface Reduction rules to block Office applications from creating child processes
Deploy Group Policy to disable execution of embedded files within OneNote documents
Isolate high-risk users behind application control policies that restrict script interpreter execution

bash

# Configuration example: enable Attack Surface Reduction rule blocking Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a `
                 -AttackSurfaceReductionRules_Actions Enabled