Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to version 1.1.1, a maliciously crafted `.onetoc2` table-of-contents file can cause `Parser::parse_notebook` to open arbitrary files on the host filesystem outside the notebook's directory. The parser reads entry names listed inside the `.onetoc2` and joins them against the notebook's base directory without validating that they are relative paths confined to that directory. The parser will bail out when the target file fails to parse as a OneNote section, so direct content exfiltration through the parser's return value is not practical, though file-existence probing and denial-of-service via large or special files remain possible. Anyone using `onenote_parser` to parse .onetoc2 files received from untrusted sources is affected. Users who only ever parse their own notebooks are not at meaningful risk. The issue is fixed in onenote_parser 1.1.1. The fix rejects absolute paths, parent-directory components, and other invalid path characters in entry names, and additionally canonicalises the resolved path to confirm it stays inside the notebook's base directory. For users who cannot upgrade to 1.1.1, only call `Parser::parse_notebook` on `.onetoc2` files from trusted sources. Alternatively, use `Parser::parse_section` / `Parser::parse_section_buffer` on individual .one files, which do not perform the directory walk.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21831-1 advisory.

    - CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
    - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records     (bsc#1274598).
    - CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-     bounds write       (bsc#1274599).
    - CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names     (bsc#1274600).
    - CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
    - CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a     crash       (bsc#1274602).
    - CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit     bypass       (bsc#1274603).
    - CVE-2026-46671: onenote_parser: Path traversal in `Parser:parse_notebook` allows reading files outside     the notebook       directory (bsc#1271922).
    - CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside     ClamAV's       temporary scan directory on Windows.

    Changes for clamav:

    Update to 1.5.4:

     * Fixed thread-safety issues in the clamd STATS command that could disclose      process memory or crash the daemon while scans and STATS requests run      concurrently. Also fixed partial socket-write handling used for large STATS      responses.
     * FreeBSD: Restored support for safe quarantine move and remove actions while      preserving protection against source-path replacement races.
     * Fixed an OpenSSL library-context leak in legacy hashing helpers when a      requested message digest cannot be fetched, such as when the default      provider is unavailable in a FIPS-enabled environment.
     * Upgraded the Rust crossbeam-epoch dependency to resolve the      RUSTSEC-2026-0204 advisory.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4208-1 advisory.

    - CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
    - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records     (bsc#1274598).
    - CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-     bounds write       (bsc#1274599).
    - CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names     (bsc#1274600).
    - CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
    - CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a     crash       (bsc#1274602).
    - CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit     bypass       (bsc#1274603).
    - CVE-2026-46671: onenote_parser: Path traversal in `Parser:parse_notebook` allows reading files outside     the notebook       directory (bsc#1271922).
    - CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside     ClamAV's       temporary scan directory on Windows.

    Changes for clamav:

    Update to 1.5.4:

     * Fixed thread-safety issues in the clamd STATS command that could disclose      process memory or crash the daemon while scans and STATS requests run      concurrently. Also fixed partial socket-write handling used for large STATS      responses.
     * FreeBSD: Restored support for safe quarantine move and remove actions while      preserving protection against source-path replacement races.
     * Fixed an OpenSSL library-context leak in legacy hashing helpers when a      requested message digest cannot be fetched, such as when the default      provider is unavailable in a FIPS-enabled environment.
     * Upgraded the Rust crossbeam-epoch dependency to resolve the      RUSTSEC-2026-0204 advisory.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4179-1 advisory.

    - CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
    - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records     (bsc#1274598).
    - CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-     bounds write       (bsc#1274599).
    - CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names     (bsc#1274600).
    - CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
    - CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a     crash       (bsc#1274602).
    - CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit     bypass       (bsc#1274603).
    - CVE-2026-46671: onenote_parser: Path traversal in `Parser:parse_notebook` allows reading files outside     the notebook       directory (bsc#1271922).
    - CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside     ClamAV's       temporary scan directory on Windows.

    Changes for clamav:

    Update to 1.5.4:

     * Fixed thread-safety issues in the clamd STATS command that could disclose      process memory or crash the daemon while scans and STATS requests run      concurrently. Also fixed partial socket-write handling used for large STATS      responses.
     * FreeBSD: Restored support for safe quarantine move and remove actions while      preserving protection against source-path replacement races.
     * Fixed an OpenSSL library-context leak in legacy hashing helpers when a      requested message digest cannot be fetched, such as when the default      provider is unavailable in a FIPS-enabled environment.
     * Upgraded the Rust crossbeam-epoch dependency to resolve the      RUSTSEC-2026-0204 advisory.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4180-1 advisory.

    - CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
    - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records     (bsc#1274598).
    - CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-     bounds write       (bsc#1274599).
    - CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names     (bsc#1274600).
    - CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
    - CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a     crash       (bsc#1274602).
    - CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit     bypass       (bsc#1274603).
    - CVE-2026-46671: onenote_parser: Path traversal in `Parser:parse_notebook` allows reading files outside     the notebook       directory (bsc#1271922).
    - CVE-2025-8088: ejects path separators in NTFS alternate data stream names to prevent extraction outside     ClamAV's       temporary scan directory on Windows.

    Changes for clamav:

    Update to 1.5.4:

     * Fixed thread-safety issues in the clamd STATS command that could disclose      process memory or crash the daemon while scans and STATS requests run      concurrently. Also fixed partial socket-write handling used for large STATS      responses.
     * FreeBSD: Restored support for safe quarantine move and remove actions while      preserving protection against source-path replacement races.
     * Fixed an OpenSSL library-context leak in legacy hashing helpers when a      requested message digest cannot be fetched, such as when the default      provider is unavailable in a FIPS-enabled environment.
     * Upgraded the Rust crossbeam-epoch dependency to resolve the      RUSTSEC-2026-0204 advisory.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
367990	openSUSE 16: clamav / clamav-devel / clamav-milter / libclamav12 / etc (openSUSE-SU-2026:21831-1)	Nessus	SuSE Local Security Checks	Local	high
346804	SUSE SLES15: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:4208-1)	Nessus	SuSE Local Security Checks	Local	high
346209	SUSE SLES12: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:4179-1)	Nessus	SuSE Local Security Checks	Local	high
346206	SUSE SLED15: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:4180-1)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2026-46671

medium

Tenable Plugins

high

high

high

high