A heap‑based buffer overflow in the OneNote component of Microsoft Office allows an attacker to execute code locally on a target system. The flaw is triggered when a malicious OneNote file is parsed, leading to memory corruption that permits arbitrary code execution with the privileges of the user who opens the file, potentially compromising confidentiality, integrity, and availability on the affected workstation.

The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. A security update addressing this issue is available through the Microsoft Security Update Guide.

The CVSS score of 7.8 classifies the vulnerability as high severity. The EPSS score is below 1%, indicating a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must deliver a malicious OneNote (.one) file that the victim opens, implying a user-interaction requirement to trigger the exploit. Once triggered, the exploit allows arbitrary code execution with the privileges of the local user.