The vulnerability is an integer overflow or wraparound that occurs within Microsoft Office SharePoint, enabling an attacker with authorized network access to execute arbitrary code. This flaw is identified as a heap-based buffer overflow (CWE-122) and an integer overflow (CWE-190). Successful exploitation would allow the attacker to run malicious code with the privileges of the SharePoint process, potentially compromising the confidentiality, integrity, and availability of the affected system.

The affected product is Microsoft SharePoint Server Subscription Edition from Microsoft. No specific version information is listed in the CVE, so all installations of the subscription edition should be reviewed and updated as soon as possible.

The CVSS score for this vulnerability is 8.8, indicating a high level of severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV database. The attack requires an authorized user or a trusted network‑level attacker to initiate the exploit. While the lack of EPSS data does not preclude exploitation, the high CVSS indicates significant risk if unpatched, especially in environments where SharePoint is exposed to a wide network perimeter.