Deserialization of untrusted data within the Microsoft Office SharePoint Server allows an attacker who has authorized access to the system to execute arbitrary code over the network. The flaw resides in the handling of serialized objects (CWE‑502) and can result in the attacker gaining system‑level control, potentially compromising data confidentiality, integrity, and availability.

Microsoft SharePoint Server Subscription Edition is affected. No specific version numbers are listed, so all installations of the Subscription Edition require review for the presence of this flaw.

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score of 2% indicates a low but non‑zero exploitation probability, and it is not listed in the CISA KEV catalog. The likely attack vector is over the network, leveraging the ability to inject serialized data into SharePoint services that an authorized user can access. An attacker who is authenticated to the SharePoint environment can exploit this flaw to run code on the server.