Description

Incomplete list of disallowed inputs in Microsoft Office OneNote allows an unauthorized attacker to bypass a security feature locally.

Classification

CVE ID: CVE-2025-29822

CVSS Base Severity: HIGH

CVSS Base Score: 7.8

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Affected Products

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft

Product: Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft OneNote, Microsoft Office LTSC 2024, Microsoft OneNote 2016, Microsoft Office LTSC for Mac 2024, Microsoft Office LTSC for Mac 2021

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.48% (probability of being exploited)

EPSS Percentile: 63.65% (scored less or equal to compared to others)

EPSS Date: 2025-04-18 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2025-29822
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29822

Timeline