A stack-based buffer overflow has been discovered in Microsoft Exchange Online that allows an attacker who is already authorized to execute arbitrary code over a network connection. The flaw is triggered by malformed input that overflows the stack, giving the attacker the ability to run code with the privileges of the affected service.

Microsoft’s Exchange Online service is impacted. No specific version range is published, so all deployments of Exchange Online that have not received the latest security patch are considered vulnerable.

The CVSS score of 7.5 indicates a high impact, and while the EPSS score is currently unavailable, the absence of a KEV listing does not reduce its significance. Exploitation requires network access and an authorized user account, suggesting that attackers with legitimate credentials could leverage the flaw to compromise the application’s code execution context.