PatchSiren

msiemens CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM msiemens CVE published 2026-07-20

CVE-2026-46671

The CVE-2026-46671 vulnerability in Rust OneNote File Parser allows for arbitrary file opening on the host filesystem. A maliciously crafted `.onetoc2` table-of-contents file can cause `Parser::parse_notebook` to open arbitrary files on the host filesystem outside the notebook's directory. This issue arises because the parser reads entry names listed inside the `.onetoc2` and joins them against the notebo [truncated]