A use‑after‑free flaw in Microsoft Office OneNote can allow an attacker with local access to manipulate freed memory, potentially causing the application to execute arbitrary code with elevated privileges. The vulnerability is categorized as a memory management error (CWE‑416) and could lead to a full compromise of the user account if exploited. It does not provide remote code execution on its own, but elevates the attacker's capabilities within the user’s session.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024 are all impacted by this flaw. The affected versions are those listed under the vendor/product names mentioned above; specific patch levels are not detailed beyond inclusion of these product lines.

The flaw has a CVSS score of 7.8, indicating a high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that while the theoretical risk is significant, no widespread exploitation is currently documented. Exploitation requires a local user who can run Office, making the threat primarily relevant to environments where user accounts are not highly privileged or where users run Office with elevated rights.