The vulnerability occurs when the Rust OneNote parser reads a maliciously crafted .onetoc2 file that contains entry names combined with the notebook base directory without validation, allowing path traversal. The parser joins the entry names to the base path, so absolute or parent‑directory components are not rejected. Although the parser will fail to parse a file that is not a valid OneNote section and therefore does not return its contents, it still permits an attacker to probe whether arbitrary files exist on the host filesystem and can trigger denial‑of-service by pointing to large or specially crafted files. This issue affects any use of onenote_parser 1.0.x–1.1.0 that parses .onetoc2 files from untrusted sources; users who only parse locally created notebooks are not at meaningful risk. The flaw is fixed in onenote_parser 1.1.1, which rejects absolute paths, parent‑directory components, and invalid path characters, and canonicalises the resolved path to ensure it remains inside the notebook’s base directory.

All users of the onenote_parser crate from the source repository msiemens:onenote.rs that rely on the Parser::parse_notebook function and are using a version earlier than 1.1.1 are potentially affected. This includes any Rust projects that import the crate and parse .onetoc2 files received from external or untrusted sources. Projects that only parse notebooks created locally or that never use the parse_notebook entry point are not at meaningful risk.

The CVSS score is 4.4, indicating a moderate severity. The EPSS score is available and is < 1%, denoting a very low probability of exploitation. The vulnerability is not listed in KEV. The likely attack vector is an attacker supplying a malicious .onetoc2 file to a running application that uses Parser::parse_notebook. Because the function performs a directory walk, the attack requires the attacker to deliver the crafted table‑of‑contents file to the application’s local environment; network exposure is not required. The risk is mitigated if the parser is updated to a newer version that rejects absolute or parent‑directory components and validates path containment.