PT-2026-42697 · Git+2 · Onenote.Rs+1
CVE-2026-46671
·
Published
2026-05-21
·
Updated
2026-07-23
CVSS v3.1
4.4
Medium
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
onenote parser versions prior to 1.1.1
Description
A flaw exists where a maliciously crafted
.onetoc2 table-of-contents file can cause the Parser::parse notebook() function to open arbitrary files on the host filesystem outside the notebook's directory. This occurs because the parser joins entry names from the .onetoc2 file with the notebook's base directory without validating that the paths are relative and confined to that directory. While direct content exfiltration is impractical because the parser fails if the target file is not a valid OneNote section, this issue allows for file-existence probing and denial-of-service attacks using large or special files.Recommendations
Update to version 1.1.1.
As a temporary workaround, only call
Parser::parse notebook() on .onetoc2 files from trusted sources.
As a temporary workaround, use Parser::parse section() or Parser::parse section buffer() on individual .one files to avoid the directory walk.Exploit
Fix
DoS
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Onenote.Rs
Onenote Parser