Deserialization of untrusted data within Microsoft Office SharePoint, if exploited by an attacker who has authorized access to a SharePoint instance, can allow that attacker to execute arbitrary code over the network. The flaw maps to CWE-502, indicating an unsafe deserialization process. The impact is a full compromise of the affected SharePoint server, granting the attacker the privileges of the executing account.

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are all affected. The vulnerability applies to all supported versions of these products unless a specific patch has been applied.

The vulnerability carries a CVSS score of 8.8, placing it in the high severity range. EPSS data is unavailable, so while the theoretical risk is high, the probability of exploitation has not been quantified by available metrics. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is an authenticated SharePoint user who uploads or manipulates data that will be deserialized by the server. An attacker could immediately gain code execution on the SharePoint web server or services running under its context.