Local code execution via untrusted deserialization

Deserialization of untrusted data in Microsoft SharePoint Server allows attackers to execute code locally on affected servers. Microsoft identifies the flaw in SharePoint's deserialization handling, which processes untrusted serialized data, but has not disclosed the responsible component, entry point, or object type. Exploitation requires local access and high-complexity conditions but no prior privileges or user interaction, and successful exploitation grants code execution in the SharePoint process context.