CVE-2026-55133: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55133 Overview

CVE-2026-55133 is a heap-based buffer overflow [CWE-122] in Microsoft Office OneNote. The vulnerability allows an unauthorized attacker to execute arbitrary code locally on affected systems. Exploitation requires user interaction, typically opening a crafted OneNote document. Successful exploitation compromises the confidentiality, integrity, and availability of the affected host.

Microsoft published the advisory through the Microsoft Security Response Center (MSRC). The flaw affects both Windows and macOS editions of Microsoft 365 Apps, Microsoft 365, Office LTSC 2021, and Office LTSC 2024. No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
An attacker who convinces a user to open a malicious OneNote file can execute code in the context of the current user, leading to full compromise of the local session.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS
Microsoft Office LTSC 2021 for macOS and Microsoft Office LTSC 2024 for macOS

Discovery Timeline

2026-07-14 - CVE-2026-55133 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55133

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Microsoft Office OneNote's file parsing logic. When OneNote processes a malformed document, the application writes data past the bounds of a heap-allocated buffer. This overwrite can corrupt adjacent heap metadata or object pointers used later during execution.

An attacker who controls the overflowed data can steer program flow toward attacker-supplied code. Because the process runs under the invoking user's account, the attacker inherits that user's file, network, and application access. The attack vector is local and requires user interaction, which aligns with the typical delivery pattern of malicious Office documents through email, chat, or web download.

The issue is classified under [CWE-122] Heap-based Buffer Overflow. Exploitation does not require any prior privileges on the target system.

Root Cause

The root cause is improper validation of a length or size field during parsing of OneNote content structures. The parser allocates a heap buffer based on one value and copies data based on a different, attacker-controlled value. This mismatch permits an out-of-bounds heap write that corrupts memory required for later control-flow decisions.

Attack Vector

An attacker crafts a malicious .one or related OneNote file containing the malformed structure. Delivery typically occurs through phishing email attachments, malicious links, or shared cloud storage. When the target opens the file in a vulnerable OneNote client, parsing triggers the overflow and executes attacker code in the user's context.

No verified exploit code is publicly available. Refer to the Microsoft Security Vulnerability Advisory for vendor-supplied technical detail.

Detection Methods for CVE-2026-55133

Indicators of Compromise

Unexpected child processes spawned by ONENOTE.EXE or Microsoft OneNote on macOS, such as cmd.exe, powershell.exe, wscript.exe, bash, or osascript.
OneNote crashes or Windows Error Reporting entries referencing heap corruption in onenote.exe shortly after opening an emailed or downloaded file.
Newly written executables, scripts, or scheduled tasks in user-writable directories following OneNote document open events.

Detection Strategies

Hunt for process lineage where OneNote spawns command interpreters, scripting engines, or LOLBins such as mshta.exe, rundll32.exe, or regsvr32.exe.
Correlate email or download telemetry containing OneNote attachments with subsequent process execution and network callbacks from the OneNote process tree.
Alert on OneNote making outbound network connections to non-Microsoft infrastructure, especially rare or newly registered domains.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and from injecting into other processes.
Forward Sysmon Event IDs 1 (process create), 11 (file create), and 3 (network connect) for the OneNote process to a SIEM for retrospective hunting.
Track patch deployment coverage for OneNote across Windows and macOS endpoints and flag hosts still running vulnerable builds.

How to Mitigate CVE-2026-55133

Immediate Actions Required

Apply the Microsoft security update for OneNote referenced in the Microsoft Security Vulnerability Advisory to all Windows and macOS endpoints running affected Office builds.
Prioritize patching for users who routinely receive OneNote files from external senders, including finance, HR, and executive staff.
Instruct users to avoid opening OneNote attachments from untrusted or unexpected sources until patching completes.

Patch Information

Microsoft has released fixes through the standard Microsoft 365 Apps update channels and via the MSRC advisory for CVE-2026-55133. Administrators should validate that Click-to-Run channels and macOS Office installations have received the latest cumulative update. Confirm patch status using Microsoft Endpoint Manager, WSUS, Jamf, or equivalent management tooling.

Workarounds

Configure Microsoft Defender for Office 365 or an equivalent email security gateway to inspect and quarantine OneNote attachments from external senders.
Enable the Attack Surface Reduction rule Block all Office applications from creating child processes (GUID D4F940AB-401B-4EFC-AADC-AD5F3C50688A) to break common post-exploitation chains.
Restrict execution of OneNote files originating from the internet zone using Mark-of-the-Web enforcement and Group Policy Protected View settings.

bash

# Enable ASR rule to block Office child process creation (Windows PowerShell, run as admin)
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Verify the rule state
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids