onenote vulnerabilities and fixes

Recent CVEs affecting onenote, with upgrade or downgrade steps. 3 tracked.

onenote has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-04-08. Highest priority: CVE-2024-41159 (score 49/100).

• CVE-2025-29822 HIGH 7.8 DOWNGRADE DOWNGRADE Incomplete list of disallowed inputs in Microsoft Office OneNote allows an unauthorized attacker to bypass a s
• CVE-2025-21402 HIGH 7.8 DOWNGRADE DOWNGRADE Microsoft Office OneNote Remote Code Execution Vulnerability
• CVE-2024-41159 HIGH 7.1 DOWNGRADE A library injection vulnerability exists in Microsoft OneNote 16.83 for macOS

FAQ

How do I fix onenote vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is onenote being exploited right now?

None of the tracked onenote CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which onenote CVE should I patch first?

CVE-2024-41159 currently ranks highest (49/100): A library injection vulnerability exists in Microsoft OneNote 16.83 for macOS.

RSS feed for onenote · ← Back to latest CVEs