CVE-2026-96997: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CVE-2026-96997, involves a use-after-free condition in Microsoft Office OneNote, part of Microsoft 365 Apps for Enterprise. The flaw enables an attacker who already has local access and limited privileges to escalate their privileges on the affected system. The CVSS v3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability affects specific versions including =16.0.1, =1.0.0, >=16.0.1 <16.0.14334.20974, >=16.0.0 <16.0.17932.21056, and =16.0.0. Microsoft has issued an official fix and manages remediation for this cloud service. There are no known exploits in the wild at this time.

An authorized local attacker can exploit this use-after-free vulnerability to elevate privileges, potentially gaining higher-level access than intended. The impact includes complete compromise of confidentiality, integrity, and availability of the affected system components related to Microsoft Office OneNote.

An official fix is available from Microsoft. Users and administrators should apply the vendor-provided updates as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96997. Since this is a cloud-hosted service, Microsoft manages remediation server-side. No additional mitigation steps are indicated by the vendor.