Microsoft Exchange Online EUVD-2026-108540

Exploitation requires an authenticated, low-privileged account on Microsoft Exchange Online (CVSS PR:L) and a network path to the service (AV:N); no user interaction is needed (UI:N). The high attack complexity (AC:H) means success depends on conditions beyond the attacker's direct control, though the available sources do not describe what those conditions are or how the stack overflow is triggered. Because Exchange Online is a vendor-hosted cloud service, the attack surface and remediation are controlled by Microsoft rather than by on-premises configuration; the trigger mechanism is not described in the available sources. The limiting factors reducing realistic risk are the required authentication and the high complexity.

The CVSS 3.1 base score is 7.5 (High), but the temporal signals temper real-world urgency: E:U (Exploit Code Maturity: Unproven) indicates no functional exploit is known, RL:O confirms an official fix is available, and RC:C marks the report as Confirmed. The vector combines network reach (AV:N) and high impact (C:H/I:H/A:H) with two meaningful brakes - AC:H (high attack complexity) and PR:L (the attacker must already be authenticated). No EPSS score was provided, so exploitation probability cannot be quantified, and there is no CISA KEV listing and no PoC reference in the input, consistent with the E:U rating. The vuln.today decision label is 'this_week' rather than act_now/emergency, aligning with a serious-but-not-actively-exploited profile. Net assessment: this is a genuine high-severity code-execution flaw worth patching promptly, but the combination of required authentication, high complexity, and absence of any exploitation evidence places it below drop-everything priority. One structural caveat: Microsoft Exchange Online is a vendor-operated cloud service, so remediation is largely applied by Microsoft server-side rather than by customer administrators - verify your tenant's exposure and the applicable guidance in the MSRC advisory.

An attacker who already holds valid (low-privilege) credentials to the Exchange Online environment sends specially crafted network input that overflows a fixed-size stack buffer in the affected component, corrupting the stack to achieve code execution. The high attack complexity (AC:H) implies the attacker must satisfy conditions beyond their direct control for the overflow to succeed reliably. No public exploit code has been identified at time of analysis.