Key points
- CVE-2026-102858 is a high-severity heap-based buffer overflow in OneNote for Mac.
- Affected versions include Office 365, LTSC 2021, and LTSC 2024 for Mac.
- The flaw allows unauthorized attackers to execute code over a network.
Microsoft has released security updates for Microsoft Office OneNote on macOS to address a remote code execution vulnerability identified as CVE-2026-102858. The flaw affects specific editions of the productivity suite, requiring immediate attention from administrators managing Mac fleets. The issue stems from a heap-based buffer overflow within the application, which can be exploited by unauthorized attackers over a network to run arbitrary code on affected systems.
In plain English
A buffer overflow occurs when a program writes more data to a memory location than it can hold. In this case, the overflow happens in the heap, a part of memory used for dynamic allocation. According to the National Vulnerability Database, this specific weakness, classified under CWE-122, allows an attacker to execute code remotely. This means someone can potentially trigger the flaw over a network connection, leading to unauthorized code execution on the target Mac.
The background
The vulnerability impacts Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. The NVD record specifies that versions released before the publication date of the fix are vulnerable. Microsoft rates the severity of CVE-2026-102858 as high, with a CVSS score of 8.8. This rating reflects the significant risk posed by remote code execution via a heap-based buffer overflow.
What changes now
Administrators must ensure all Macs running OneNote are updated to the latest versions provided by Microsoft. The updates are available through standard software update channels. Organizations using Long-Term Servicing Channel (LTSC) versions must also apply the relevant patches for their 2021 and 2024 editions. Failure to update leaves systems exposed to potential exploitation by network-based attacks, as the flaw allows for remote code execution.
Who needs to act first
Teams usually prioritize systems with high network exposure, such as those used by development or customer-facing roles. Check whether your organization uses OneNote for collaborative documents that might be accessed externally. Back up critical note files before applying the update to prevent data loss during the installation process. Test the update on a small group of Macs to ensure compatibility with other business applications. Monitor logs for any unusual activity post-update to verify the patch resolved the issue.
What to do and how to stay safe: Microsoft
- Verify the current OneNote version on all managed Macs against the fixed release notes.
- Schedule immediate patching for systems with direct internet exposure or frequent file sharing.
- Monitor network traffic for anomalies that could indicate an attempt to exploit the overflow.
- Educate users on safe file handling practices to reduce the attack surface while patches roll out.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Microsoft products are affected by CVE-2026-102858?
Microsoft Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024 are affected.
What is the severity rating of this vulnerability?
The NVD rates CVE-2026-102858 as high severity with a CVSS score of 8.8.
Can this flaw be exploited remotely?
Yes, the vulnerability allows an unauthorized attacker to execute code over a network.
