OneNote Mac heap overflow CVE-2026-102858 enables remote code execution for Office 365 and LTSC users

Microsoft has disclosed a high-severity security flaw in its Office OneNote application that enables remote code execution. The vulnerability, tracked as CVE-2026-102858, stems from a heap-based buffer overflow within the software. According to the Microsoft Security Update Guide, this defect allows an unauthorized attacker to execute code over a network.

The risk

The Common Vulnerability Scoring System assigns this issue a score of 8.8, which falls into the HIGH severity category. The National Vulnerability Database categorizes the underlying weakness as CWE-122, a heap-based buffer overflow. This type of memory corruption occurs when a program writes data past the boundary of a dynamically allocated memory block. In the context of OneNote, this overflow provides the mechanism for an attacker to run instructions on the victim’s system via a network connection.

Who is exposed

The flaw affects several versions of Microsoft Office running on macOS. Specifically, Microsoft Office 365 for Mac versions released before the upcoming publication are vulnerable. Additionally, Microsoft Office LTSC for Mac 2021 and Microsoft Office LTSC for Mac 2024, both before their respective publication dates, are exposed. Organizations relying on these long-term service channel builds for their Mac environments face exposure until the vendor issues the necessary security updates.

Cost and compliance

The source material does not provide specific details regarding financial costs, regulatory penalties, or compliance framework impacts associated with CVE-2026-102858. No information is available in the advisory or NVD record concerning mandated reporting requirements or insurance implications for this specific buffer overflow vulnerability.

What to watch

Security teams should monitor for the official release of security updates for the affected Office versions. Until those updates are available, organizations should restrict network access to systems running these vulnerable OneNote builds, particularly those exposed to untrusted networks. Internal users should be advised to avoid opening OneNote files from unknown or untrusted sources over network shares.

Signals worth monitoring

Teams usually observe unusual outbound network connections from workstation endpoints that have not recently performed updates. Check whether endpoint detection platforms flag anomalous process creation or memory allocation patterns consistent with heap corruption. Look for authentication failures or unexpected privilege escalations in local logs. Containment typically involves isolating affected hosts from the internal network to prevent lateral movement while investigators verify the integrity of the compromised OneNote instances and related user profiles.

What to do and how to stay safe: Microsoft

• Inventory all macOS devices running Microsoft Office to identify those with OneNote installed.
• Verify which specific versions of Office 365 or LTSC are currently deployed in your environment.
• Restrict network access to these devices if they cannot be immediately updated.
• Once the vendor provides an update, deploy the patch to all affected systems promptly.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-102858?

The National Vulnerability Database lists the CVSS score as 8.8, which is rated as HIGH severity.

Which Microsoft Office versions for Mac are affected by this buffer overflow?

Microsoft Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024 are affected before publication.

Does this vulnerability require user interaction to exploit?

The advisory states it allows an unauthorized attacker to execute code over a network.