CVE-2025-21402: high-severity vulnerability in Microsoft Office LTSC for Mac 2021
Microsoft Office OneNote Remote Code Execution Vulnerability
Published · Updated
No sign of exploitation. No public exploitation artifact known so far.
Microsoft OneNote has a vulnerability that allows attackers to execute malicious code on your computer when you open a specially crafted document. This is dangerous because it gives attackers full control over your system.
CWE-641 vulnerability in OneNote allows remote code execution through crafted files that exploit improper handling of embedded objects or external references. Attack requires user interaction (document opening) and results in code execution with user privileges; no authentication bypass or elevated privileges required for initial compromise.
In the same product, most dangerous first.