A stack‑based buffer overflow in Microsoft Exchange Server can be triggered by an attacker who is not authenticated but can reach the server over a network. The flaw enables the attacker to execute arbitrary code on the machine, potentially taking full control of the Exchange environment and any systems it connects to. The weakness is a classic buffer overflow under CWE‑121, allowing uncontrolled memory writes that result in code execution.

Microsoft Exchange Server 2016 with Cumulative Update 23, Microsoft Exchange Server 2019 with Cumulative Updates 14 and 15, and Microsoft Exchange Server Subscription Edition RTM are affected. These versions are identified by their specific cumulative update or RTM build numbers and are commonly deployed in enterprise and cloud‑hosting environments.

The flaw carries a CVSS score of 8.1, classifying it as high severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote over a network, requiring only that an attacker reach the vulnerable component, which is typically exposed through standard Exchange protocols. Because the vulnerability does not require authentication and can be exploited from an unauthenticated network connection, the potential impact is widespread and the likelihood of exploitation is significant for exposed servers.