Stack-based buffer overflow in Microsoft SharePoint Server - CVE-2026-88166
Published: October 14, 2026
Vulnerability identifier: #VU155360
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-88166
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to integer overflow or wraparound and a stack-based buffer overflow in Microsoft Office SharePoint when accessed over a network. A remote user can exploit the vulnerability over the network to execute arbitrary code.
Exploitation requires Manage List permissions. The Preview Pane is not an attack vector.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-88166
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20190