CVE-2026-96997 Microsoft CVE debrief

Who should care

Defenders and administrators responsible for Microsoft Office OneNote and related systems should assess exposure and prioritize patching. This includes operators, platforms, vulnerability management, and security teams. They should review and update affected Microsoft Office versions and monitor for local privilege escalation attempts.

Why it matters

CVE-2026-96997 is a high-severity elevation of privilege vulnerability in Microsoft Office OneNote. Defenders should prioritize patching and monitoring to prevent local privilege escalation.

• Local privilege escalation is possible
• Patching is required to prevent exploitation
• Monitoring for suspicious activity is recommended

Technical summary

A use-after-free vulnerability in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally. The vulnerability has a high severity with a CVSS score of 7.8. This issue affects Microsoft Office OneNote and related systems. Defenders should prioritize verifying and applying patches for Microsoft Office OneNote, especially in environments where local access can be controlled.

Defensive priority

Defenders should prioritize verifying and applying patches for Microsoft Office OneNote, especially in environments where local access can be controlled.

Recommended defensive actions

• Verify and apply patches for Microsoft Office OneNote
• Review and update affected Microsoft Office versions
• Monitor for local privilege escalation attempts

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information on exploitation or impact is limited. Defenders should verify and apply patches for Microsoft Office OneNote, especially in environments where local access can be controlled. The vulnerability has a high severity with a CVSS score of 7.8. There is no information on known ransomware campaign use or exploitation. The CVE record was published on 2026-10-13T19:00:36.393Z and has not been The de

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.