CVE-2026-102858: Microsoft 365 Buffer Overflow Vulnerability

CVE-2026-102858 Overview

CVE-2026-102858 is a heap-based buffer overflow [CWE-122] in Microsoft Office OneNote that allows an unauthenticated attacker to execute arbitrary code over a network. The flaw affects OneNote components shipped with Microsoft 365, Office 2021, and Office 2024 on macOS. Successful exploitation requires user interaction, typically opening a crafted OneNote notebook or attachment delivered through phishing or a malicious web link. Microsoft published the advisory through its Security Update Guide and classified the issue as a remote code execution vulnerability.

Critical Impact
An attacker who convinces a user to open a malicious OneNote file can execute code in the context of the current user, enabling full compromise of the affected macOS workstation.

Affected Products

Microsoft 365 Apps for macOS
Microsoft Office LTSC 2021 for macOS
Microsoft Office LTSC 2024 for macOS

Discovery Timeline

2026-10-13 - CVE-2026-102858 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-102858

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in Microsoft OneNote's file parsing logic on macOS. OneNote processes a wide range of embedded objects, images, and ink data stored in its proprietary .one notebook format. When the parser handles a malformed section or object, it writes past the bounds of a heap allocation. The resulting corruption can overwrite adjacent heap metadata or object pointers used later during rendering. An attacker who controls the overwritten memory can hijack control flow and run native code within the Office process. Because the Office application typically runs with the signed-in user's privileges, successful exploitation grants the attacker that user's full access to files, credentials cached by Office, and connected cloud resources.

Root Cause

The root cause is improper validation of a length or offset field in a OneNote structure before data is copied into a heap buffer. The parser trusts attacker-controlled size values, which allows an oversized write into an undersized allocation. This pattern maps directly to [CWE-122] Heap-based Buffer Overflow.

Attack Vector

The attack is remote and requires user interaction. An attacker crafts a malicious OneNote notebook or embedded object and delivers it by email attachment, chat link, cloud share, or drive-by download. When the user opens the file in a vulnerable Office build, parsing triggers the overflow and executes the attacker's payload. No prior authentication to the target system is required.

See the Microsoft Security Update Guide entry for CVE-2026-102858 for vendor technical details.

Detection Methods for CVE-2026-102858

Indicators of Compromise

OneNote (.one, .onepkg, .onetoc2) files arriving from untrusted senders, especially with embedded objects or scripts.
Unexpected child processes spawned by Microsoft OneNote.app such as shells, osascript, curl, or python3.
OneNote process crashes with heap corruption signatures recorded in macOS crash reports under ~/Library/Logs/DiagnosticReports/.
Outbound network connections from the OneNote process to previously unseen domains shortly after a file is opened.

Detection Strategies

Hunt for process-lineage anomalies where Office applications spawn interpreters or networking utilities on macOS endpoints.
Inspect email and collaboration platforms for OneNote attachments and apply sandbox detonation before delivery.
Correlate file-open telemetry with subsequent script execution or persistence creation in the user's LaunchAgents directory.

Monitoring Recommendations

Enable macOS Endpoint Security framework telemetry for process execution, file writes, and network connections originating from Office applications.
Alert on OneNote reading files from unusual paths such as /tmp, mounted DMG volumes, or user Downloads immediately before a crash event.
Track Office application versions across the fleet to confirm patch coverage and surface stragglers.

How to Mitigate CVE-2026-102858

Immediate Actions Required

Apply the Microsoft Office security updates for macOS referenced in the MSRC advisory as soon as they are available in your update ring.
Block or quarantine inbound OneNote file types at the email gateway until patching is verified across endpoints.
Warn users against opening unsolicited OneNote notebooks and reinforce reporting workflows for suspicious attachments.

Patch Information

Microsoft has published updates addressing CVE-2026-102858 for Microsoft 365 Apps, Office LTSC 2021, and Office LTSC 2024 on macOS. Administrators should deploy the latest Office build from the Microsoft AutoUpdate (MAU) channel and confirm installed versions through mdatp health or the Office update log. Consult the vendor advisory for the exact fixed build numbers.

Workarounds

Restrict OneNote file execution through macOS Gatekeeper and MDM policies that block unsigned or untrusted Office documents.
Configure email security to strip or sandbox OneNote attachments from external senders.
Enforce least-privilege user accounts so that successful exploitation does not yield administrative access on the host.

bash

# Verify installed Microsoft AutoUpdate state and trigger an Office update on macOS
ls "/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app"
"/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/msupdate" --list
"/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/msupdate" --install