Description

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T17:18:46.500Z",
  "pubdate": "2026-08-11T17:18:46.500Z",
  "executiveSummary": "This vulnerability involves the deserialization of untrusted data within Microsoft Office SharePoint, introducing a significant security flaw that enables remote exploitation. Classified broadly as an insecure deserialization weakness, this vulnerability allows a malicious actor to manipulate data structures processed by the application, leading to a spoofing condition over a network.\nThe primary impact of successful exploitation is unauthorized spoofing, which can compromise the integrity of communications, impersonate legitimate entities within the SharePoint environment, and undermine trust relationships established across the network architecture. The affected systems are instances of Microsoft Office SharePoint.\nRisk implications are substantial, as successful exploitation could facilitate advanced network-based attacks by abusing the application's internal data handling mechanisms. To execute this attack, the adversary must possess authorization to interact with the target SharePoint deployment over the network, indicating that the threat model includes authenticated positioning or access within the trust boundary.\nMitigation requires applying vendor-supplied security updates and hardening SharePoint configurations to restrict the processing of untrusted serialized objects. Security analysts and administrators must monitor network traffic and application logs for anomalous deserialization patterns or unauthorized tampering attempts targeting Microsoft Office SharePoint infrastructure.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling and deserialization of untrusted data streams by Microsoft Office SharePoint. When the application reconstructs serialized objects without properly validating or sanitizing the input data, it creates an opportunity for malicious manipulation. An authorized attacker can craft specialized payloads containing malicious object graphs or serialized data structures designed to exploit the deserialization logic.\nThe attack flow commences over a network channel where the attacker, possessing the requisite authorization, transmits the malformed serialized payload to the vulnerable Microsoft Office SharePoint component. Upon receipt, the application processes the untrusted input through its internal deserialization routines. Because the application fails to enforce strict type checking or cryptographic integrity validation on the incoming serialized streams, the injected data is instantiated into memory.\nThis improper instantiation alters the expected program state and execution flow, allowing the attacker to achieve spoofing capabilities. The vulnerability exposure is network-based, requiring the attacker to have network connectivity to the SharePoint service and a valid authorization context to interact with the vulnerable endpoint. Privilege requirements dictate that the attacker must be authorized within the system context, yet they can leverage this access to bypass intended security boundaries and spoof communications or system entities.\nThe post-exploitation impact centers primarily on spoofing, enabling the adversary to masquerade as trusted components, services, or users within the SharePoint ecosystem. This compromises the authenticity of network transactions and data exchanges processed by the application. Detailed analysis of memory structures and application logs during such events reveals abnormal object creation patterns indicative of deserialization exploitation."
}