{"id":"CVE-2026-88155","published":"2026-10-13T19:21:35.590","lastModified":"2026-10-14T19:44:38.500","description":"Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-122"],"vendors":["microsoft"],"products":["sharepoint server"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88155","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A heap-based buffer overflow in Microsoft SharePoint Server allows authenticated attackers to execute arbitrary code remotely. This vulnerability arises from insufficient bounds checking when processing user-supplied data, potentially enabling remote code execution with high impact.","exploitability":"Exploitation requires an authenticated user account with access to SharePoint Server, making it moderately difficult but achievable through social engineering or credential compromise.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on SharePoint servers, potentially leading to full system compromise and data exfiltration across the organization's SharePoint infrastructure.","remediation":"Apply Microsoft Security Update MS26-088 for SharePoint Server 2019 and SharePoint Server 2021, or upgrade to SharePoint Server 2026 or later versions.","detection":"Monitor for unusual network traffic patterns from SharePoint servers to external endpoints, particularly when authenticated users access SharePoint services. Look for anomalous memory usage patterns in SharePoint processes or unexpected process creation events related to SharePoint web applications.","tags":["rce","sharepoint","authenticated","remote"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:04:59.094Z"}}