The vulnerability is a flaw in the deserialization of untrusted data in Microsoft Office SharePoint. Because the deserialization path is available to users who have authorized access, an adversary with such access may craft malicious data that is processed by SharePoint and thereby increase the privileges they hold on the network. This is a pure privilege‑escalation issue; no other security properties are explicitly affected in the description.

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are listed as affected. Version details are not specified in the CNA data, so all known releases of the mentioned products carry the same risk until a patch is applied.

The CVSS score of 8.8 places the flaw in the high‑severity range. The EPSS score is not available, which means there is no public information about exploitation frequency, and the vulnerability does not appear in the CISA KEV catalog. The attack requires an attacker who already has some form of authorized SharePoint access; the flaw is activated when that authorized user submits crafted data over the network that is then deserialized by SharePoint.