Onenote
Vendor:
First CVE: Sep 28, 2004 · Active for 21 years
16
Total CVEs
More Total CVEs than 92% of tracked products
1.3
Avg CVEs / Year
Higher CVE frequency than 55% of tracked products
7.7
Avg CVSS
Higher Avg CVSS than 62% of tracked products
6.3%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Onenote over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 28, 2004
21 years ago
Most Recent CVE
Mar 16, 2026
130 days ago
CVE Severity & Scoring
Onenote16 CVEs
25%
75%
All CVEs352,294 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local5 (31.3%)
Network7 (43.8%)
Unknown4 (25.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low12 (75.0%)
High0 (0.0%)
Unknown4 (25.0%)
User Interaction
None2 (12.5%)
Unknown4 (25.0%)
Required10 (62.5%)
Privileges Required
Low3 (18.8%)
High0 (0.0%)
None9 (56.3%)
Unknown4 (25.0%)
Top CVEs
Signals from CVEs in this product scope (16 CVEs).
16 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2007-0671HIGH Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code v | Feb 3, 2007 | 8.8 | 84 | YES | NO |
CVE-2004-0200HIGH Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via | Sep 28, 2004 | 9.3 | 68 | NO | YES |
CVE-2014-2815HIGH Microsoft OneNote 2007 SP3 allows remote attackers to execute arbitrary code via a crafted OneNote file that triggers creation of an executable file in a startup folder, aka "OneNo | Aug 12, 2014 | 8.8 | 44 | NO | NO |
CVE-2017-8509HIGH A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". Thi | Jun 15, 2017 | 8.8 | 34 | NO | NO |
CVE-2016-3315MEDIUM Microsoft OneNote 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016, and 2016 for Mac allow remote attackers to obtain sensitive information via a crafted OneNote file, aka "Microsof | Aug 9, 2016 | 5.5 | 34 | NO | NO |
CVE-2015-2503HIGH Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 200 | Nov 11, 2015 | 9.3 | 30 | NO | NO |
CVE-2017-0197HIGH Microsoft OneNote 2007 SP3 and Microsoft OneNote 2010 SP2 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office DLL Loading Vulnerability." | Apr 12, 2017 | 7.8 | 29 | NO | NO |
CVE-2008-3068HIGH Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary UR | Jul 7, 2008 | 7.5 | 28 | NO | NO |
CVE-2006-3877HIGH Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office 2002, Office 2003, Office 2004 for Mac, and Office v.X for Mac allows user-assisted attackers to execute ar | Oct 10, 2006 | 9.3 | 28 | NO | NO |
CVE-2026-26133HIGH AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. | Mar 16, 2026 | 7.1 | 26 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (16 CVEs).
CISA KEV
1 CVE
6.2% of CVEs· 97th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
6.2% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (16 CVEs).
Media Mentions
Signals from CVEs in this product scope (16 CVEs).
Top CNAs Publishing CVEs For Onenote
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2021 | 1 | 5.4 | 0.4% | 0 | 0 |
| 2019 | 1 | 5.4 | 0.4% | 0 | 0 |
| 2016 | 4 | 7.0 | 12.0% | 0 | 0 |
| 2013 | 3 | 6.7 | 15.7% | 0 | 0 |
| 2010 | 4 | 7.8 | 20.7% | 0 | 0 |
| 2007 | 4 | 7.8 | 27.4% | 0 | 0 |
| 2003 | 4 | 8.7 | 30.3% | 1 | 1 |
| 16.83 | 1 | 7.1 | 0.8% | 0 | 0 |