CVE-2026-88166

Executive Summary

CVE-2026-88166 is an integer overflow or wraparound vulnerability in Microsoft Office SharePoint that permits an authenticated, network-positioned attacker to execute arbitrary code, carrying a CVSS v3.1 base score of 8.8 (High). The flaw is classified by NVD as CWE-121 (Stack-based Buffer Overflow), indicating the integer wraparound both triggers and is compounded by a stack memory corruption primitive. Any organization exposing SharePoint to untrusted or partner-authenticated users is potentially affected, and no patch, public proof-of-concept, or CISA KEV entry currently exists — leaving defenders reliant on compensating controls.

Technical Analysis

The vulnerability is described as an "integer overflow or wraparound" in Microsoft Office SharePoint that results in code execution over a network. NVD assigns the CWE-121 (Stack-based Buffer Overflow) classification. Reconciling these two data points yields the likely mechanism: an arithmetic operation on a length, size, or count value used in memory management (allocation, copy, or bounds calculation) wraps past the maximum value of its integer type. The wrapped value is then used as a size argument in a stack-buffer operation, producing an out-of-bounds write onto the stack.

Because the description does not disclose the specific component, endpoint, parameter, or function involved, the following must be stated plainly: no verbatim identifiers (function names, class names, URL paths, API parameters) are available from the supplied NVD Description or CNA Title. The CNA Title field is empty, so no product sub-component can be attributed. Any claim naming an exact SharePoint assembly or method would be fabrication and is deliberately omitted.

What can be asserted with confidence from the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H:

• AV:N — exploitable remotely over the network; no physical or adjacent access required.
• AC:L — no unusual preconditions or race conditions; the attacker controls the trigger reliably.
• PR:L — the attacker must be an authenticated, low-privileged user. This is an "authorized attacker" per the description, not an anonymous internet actor.
• UI:N — no victim user interaction is required.
• S:U — the exploitation does not cross a security authority boundary (the vulnerable component and impacted component are the same).
• C/I/H = H — full loss of confidentiality, integrity, and availability within the SharePoint process context.

The integer-overflow-to-stack-overflow class typically manifests as heap/stack corruption when a crafted request body, header, or serialized object is processed by a server-side parser. The fact that the CVSS vector lists high confidentiality, integrity, and availability impact is consistent with an in-process remote code execution primitive rather than a denial-of-service wraparound alone.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for CVE-2026-88166. The attack chain below is inferred at the vulnerability-class level only; it contains no invented endpoints, methods, or parameters.

1. Reconnaissance / target identification. The attacker identifies an externally reachable SharePoint instance (internet-facing or reachable from a partner network) by fingerprinting the web tier with standard Shodan/HTTP-title/SSL certificate techniques. The attacker must already possess valid credentials or be able to self-register or authenticate through a trusted federated identity — consistent with the PR:L requirement.

2. Triggering the flaw class. The attacker, now authenticated, sends a crafted network request (HTTP/HTTPS) designed to satisfy the precondition of the integer wraparound: a value representing a length, count, or serialized size is supplied such that server-side arithmetic overflows the integer type. The request must reach the code path that performs the vulnerable calculation. Because no component detail is available, this step cannot be attributed to a specific URL or API — defenders should assume any SharePoint endpoint processing attacker-influenced numeric metadata is in scope.

3. Execution method (class level). The wrapped integer is used as a size operand in a stack operation, so an out-of-bounds write occurs (CWE-121). The classic exploitation approach for this class is to corrupt a return address or saved frame pointer on the stack to redirect control flow to attacker-influenced data. No payload format, gadget, or offset is documented publicly and none is asserted here.

4. Post-exploitation impact. Success yields code execution in the SharePoint application context (typically the IIS worker process identity). Given S:U and C/I/H=H, the attacker gains full read/write over data and services accessible to that identity — including document libraries, list content, configuration, and any downstream resources the service account can reach. Lateral movement depends on the service account's privileges, not on this vulnerability itself.

Impact Assessment

CVSS v3.1 base score: 8.8 (High). The score is driven by complete loss of confidentiality, integrity, and availability (C:H/I:H/A:H) tempered only by the PR:L authentication requirement.

• Blast radius: every SharePoint deployment reachable by authenticated users, including partner/extranet and supply-chain-facing instances. Multi-tenant and hybrid SharePoint Online on-premises gateways should be treated as in scope until Microsoft assigns affected versions.
• Business impact: SharePoint is frequently the system of record for sensitive documents, intranet content, and workflow integrations. Code execution in this context can enable document exfiltration, tampering with records, persistence on the host, and pivoting into adjacent systems via the service account. Because integrity is high-impact, downstream trust in stored documents is compromised.
• Compounding risk: EPSS is not yet scored by FIRST.org, so no probabilistic exploitation estimate is available. The vulnerability is not listed in CISA KEV, and no patch exists (confidence 0/4). Absence from KEV and absence of a PoC reduce — but do not eliminate — near-term exploitation likelihood; a public PoC would materially change this assessment.
• Severity caveat: the 8.8 score assumes a sophisticated attacker who already holds credentials. For environments where SharePoint is not internet-facing and authenticated user populations are tightly controlled, effective exposure is lower than the raw vector suggests.

Detection Guidance

Sigma Rule

title: Potential SharePoint Integer Overflow Exploitation Attempt (CVE-2026-88166)
id: 4a1f0c2e-7b6d-4f3a-9c21-8e5d2b1a6f03
status: experimental
description: Detects anomalous large numeric values or oversized lengths in HTTP requests or worker process crashes consistent with integer-wraparound/stack overflow exploitation in SharePoint.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88166
author: valtersit.com
logsource:
  category: webserver
  product: iis
detection:
  selection_request:
    cs-uri-query|re: '(?i)(len|size|count|offset|id)=\d{10,}'
  selection_status:
    sc-status:
      - 500
      - 502
  condition: selection_request or (selection_request and selection_status)
falsepositives:
  - Legitimate applications submitting unusually large numeric parameters
level: high
tags:
  - attack.t1190
  - cve.2026.88166

YARA Rule

rule CVE_2026_88166_SharePoint_Exploit_Artifacts
{
    meta:
        description = "Detects artifacts consistent with CVE-2026-88166 SharePoint integer overflow / stack overflow exploitation"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88166"
        date = "2026-01-01"
        severity = "high"

    strings:
        $sp = "MicrosoftSharePoint" ascii nocase
        $ow = "OfficeServer" ascii nocase
        $crash1 = "StackOverflowException" ascii
        $crash2 = "ArithmeticException" ascii
        $crash3 = "OutOfMemoryException" ascii
        $marker = "0x7fffffff" ascii
        $marker2 = "4294967295" ascii

    condition:
        (uint16(0) == 0x5A4D) and
        filesize < 50MB and
        (($sp or $ow) and any of ($crash*) and any of ($marker*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-88166 Potential Microsoft SharePoint Integer Overflow Exploitation Attempt"; flow:established,to_server; http.method; content:"GET"; http.method; content:"POST"; http.uri; pcre:"/(len|size|count|offset|id)=\d{10,}/i"; reference:cve,2026-88166; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88166; classtype:attempted-admin; sid:202688166; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5m
  [ network where
      network.protocol == "http" and
      http.request.method in ("GET", "POST") and
      stringContains(network.http.request.body, "size=") or
      stringContains(network.http.request.body, "len=") ]
  [ file where
      process.name == "w3wp.exe" and
      event.action == "creation" and
      file.extension in ("tmp", "log") ]

Splunk SPL Query

index=web (sourcetype=iis OR sourcetype=sharepoint_usage)
| eval uri=coalesce(cs_uri, cs_uri_query, uri)
| where match(uri, "(?i)(len|size|count|offset|id)=\d{10,}") OR sc_status IN (500, 502)
| stats count min(_time) as first_seen max(_time) as last_seen values(sc_status) as statuses values(uri) as uris by src_ip, user, dest
| where count > 3
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,sharepoint,cve_2026_88166,">
  <rule id="100166" level="12">
    <if_sid>31100</if_sid>
    <field name="url">(len|size|count|offset|id)=\d{10,}</field>
    <description>CVE-2026-88166: Possible Microsoft SharePoint integer overflow exploitation attempt via oversized numeric parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,</group>
  </rule>
  <rule id="100167" level="10">
    <if_sid>31100</if_sid>
    <id>^50[0-9]$</id>
    <match>w3wp.exe|StackOverflow|ArithmeticException</match>
    <description>CVE-2026-88166: SharePoint worker process crash possibly associated with stack overflow exploitation</description>
    <group>attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. No vendor fix and no official workarounds are documented.

1. Immediate mitigations (compensating controls).

   • Restrict authenticated access to SharePoint. Enforce least privilege and revoke stale partner/extranet accounts; this directly raises the effective PR:L bar.
   • Place internet-facing SharePoint behind a WAF/reverse proxy with request-size and numeric-parameter validation, and enable the detection rules above.
   • Disable or tightly scope anonymous and self-registration pathways so the required authentication precondition is harder to satisfy for untrusted parties.
   • Isolate the SharePoint worker process identity: run IIS/SharePoint app pools under low-privilege service accounts with no rights beyond what SharePoint requires, limiting post-exploitation lateral movement.
   • Increase monitoring of w3wp.exe crash/restart events; repeated 500-series responses concurrent with process crashes are a strong investigative lead.

2. Patch / upgrade steps.

   • There is currently no patch. Do not report a fixed version. Monitor Microsoft's Security Update Guide and SharePoint/Office release notes; when Microsoft assigns a KB or build, verify the fix against affected-version data (currently unavailable) and test in staging before production rollout.
   • Subscribe to NVD and Microsoft MSRC advisories for CVE-2026-88166 status changes, and re-evaluate this report if CISA KEV status or EPSS changes.

3. Long-term hardening.

   • Adopt secure-by-default parameter validation at the web-tier boundary (reject/reformat oversized numeric values before they reach application code).
   • Move SharePoint behind identity-aware proxies (SSO + MFA) so the PR:L precondition implies a strongly authenticated, attributable user.
   • Maintain service-account least privilege and segmentation to contain code-execution impact.
   • Build an internal capability to test-and-deploy emergency SharePoint patches within hours of release, given the absence of a current fix.

References

• NVD — CVE-2026-88166: https://nvd.nist.gov/vuln/detail/CVE-2026-88166
• Microsoft Security Update Guide / MSRC: https://msrc.microsoft.com/update-guide
• CWE-121 (Stack-based Buffer Overflow): https://cwe.mitre.org/data/definitions/121.html
• CWE-190 (Integer Overflow or Wraparound): https://cwe.mitre.org/data/definitions/190.html
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-88166 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (CVE-2026-88166 not yet scored): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence for CVE-2026-88166 are known at the time of writing. No public PoC or exploit code is available.