Microsoft SharePoint Server: Heap-based buffer overflow allows remote code execution
Summary
A heap-based buffer overflow (CWE-122) in Microsoft Office SharePoint Server allows an authorized attacker to execute code over the network. The CVSS vector requires a valid low-privilege account (PR:L) and no user interaction, so the risk depends on who can authenticate to the server. The vulnerability is confirmed for SharePoint Server Subscription Edition; the status of SharePoint Server 2016 and 2019 is not verified.
Affected
- SharePoint Server Subscription Edition (x64) builds before 16.0.20326.20190
- SharePoint Server 2016 and 2019: Unknown.
Fixed in
- SharePoint Server Subscription Edition: build 16.0.20326.20190 via update KB5002927 (October 13, 2026). It replaces update KB5002908.
- SharePoint Server 2016 and 2019: Unknown.
Workaround
- No vendor-published workaround known. Patching is the remedy.
- General hardening: restrict SharePoint exposure to internal networks and monitor network traffic.
Exploitation
- Microsoft rates exploit maturity as Unproven and states the vulnerability is not publicly disclosed.
- Not listed in CISA KEV. CISA SSVC: exploitation none, automatable no.
- No public proof of concept or in-the-wild exploitation known as of today. Exploit repositories were not checked directly.
Our recommendation
- Check whether SharePoint Server is run on-premises and which version is installed.
- For Subscription Edition, install KB5002927 and confirm build 16.0.20326.20190.
- For SharePoint 2016 or 2019, check the MSRC product table for their fix status before assuming any.
- Limit external access to SharePoint and review accounts with valid logins.
- SharePoint Online is not affected by this patch.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Microsoft Office SharePoint
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002927
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-88155 msrc.microsoft.com
- Microsoft KB5002927 support.microsoft.com
- OpenCVE: CVE-2026-88155 app.opencve.io
- Senserva: KB5002927 senserva.com
- Stefan Goßner blog: SharePoint security fixes October 2026 blog.stefan-gossner.com
- VulDB (conflicting record) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:05.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.