Incomplete list of disallowed inputs in Microsoft Office OneNote allows an unauthorized attacker to bypass a security feature locally.

The version of Microsoft Office for Mac installed on the remote host is affected by multiple vulnerabilities as referenced in the april-15-2025 advisory.

  - Improper input validation in Microsoft Office Word allows an unauthorized attacker to bypass a security     feature over a network. (CVE-2025-29816)

  - Incomplete list of disallowed inputs in Microsoft Office OneNote allows an unauthorized attacker to bypass     a security feature locally. (CVE-2025-29822)

  - Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
    (CVE-2025-26642)

  - Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
    (CVE-2025-27750, CVE-2025-27751)

  - Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
    (CVE-2025-27747, CVE-2025-29820)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft OneNote Products are missing a security update. It is, therefore, affected by a security feature bypass vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft OneNote Products are missing a security update. They are, therefore, affected by a security feature bypass vulnerability. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the system/application.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
234490	Security Updates for Microsoft Office Products (April 2025) (macOS)	Nessus	MacOS X Local Security Checks	high
234230	Security Updates for Microsoft OneNote C2R (April 2025)	Nessus	Windows	high
234035	Security Updates for Microsoft OneNote Products (April 2025)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2025-29822

high

Tenable Plugins

high

high

high