A heap-based buffer overflow in Microsoft Office SharePoint Server Subscription Edition enables an authorized attacker to run arbitrary code via network requests. The flaw can compromise the integrity and confidentiality of the system, giving the attacker control over the SharePoint server and potentially wider network resources. The weakness is a classic offset-based overflow, allowing exploitation by sending crafted payloads that overwrite critical memory structures.

Affected vendees include Microsoft SharePoint Server Subscription Edition. No specific version numbers are disclosed, so all current installations that have not applied the latest Microsoft release are potentially vulnerable.

The CVSS score of 8.8 indicates high severity, and the lack of a public EPSS score means the exploitation likelihood is currently unknown. The vulnerability is not listed in the CISA KEV catalog, but an authorized attacker with network access to SharePoint can trigger the overflow. Since the flaw requires authenticated or otherwise authorized access, it is most likely exploited by insiders or compromised accounts, but remote exploitation remains a risk once authentication is achieved.