Microsoft SharePoint Server EUVD-2026-100175

Exploitation requires a valid low-privileged authenticated account on an affected SharePoint Server Subscription Edition instance (PR:L), and network reachability to that server; no user interaction is needed (UI:N). The limiting factor is the authentication requirement - an attacker must first obtain or be granted at least low-level credentials/access to the SharePoint application, so unauthenticated anonymous exploitation is not supported by the provided vector. Only builds of SharePoint Server Subscription Edition 16.0.0 earlier than 16.0.20326.20190 are affected; patched builds and other SharePoint editions outside this range are not indicated as vulnerable by the available data. No non-default feature toggle is named in the description, so the condition is primarily the authenticated-plus-network-access prerequisite rather than a specific optional configuration.

This is a credible, high-priority vulnerability but not a drop-everything emergency on current evidence. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity remote code execution requiring only low-level privileges and no user interaction, with full confidentiality, integrity, and availability impact - a serious combination for an internet- or intranet-facing collaboration server. However, the two signals that typically escalate priority are not present in the input: there is no CISA KEV listing (no public active-exploitation data) and no POC/exploit-code indicator, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided, so exploitation probability cannot be weighed. There is also a data tension worth verifying: the description cites an integer overflow/wraparound (CWE-190 behavior) while the assigned CWE is CWE-122 (heap-based buffer overflow) and the tags say 'Heap Overflow' - consistent with an integer overflow that leads to an undersized heap allocation, but confirm the precise root cause with Microsoft. SharePoint RCE flaws of this class have historically attracted rapid exploitation once details circulate, so despite the absence of KEV/POC signals today, patch prioritization should remain high.

An attacker who already holds a low-privileged authenticated account on a SharePoint Server Subscription Edition instance (PR:L) sends a crafted request over the network that triggers the integer overflow during a heap allocation, corrupting memory in the SharePoint process. By controlling the undersized allocation and subsequent heap write, the attacker achieves arbitrary code execution in the server context without any user interaction. No public exploit code is identified at time of analysis, but the low attack complexity makes reliable exploitation plausible once internals are understood.