CVE-2026-66307: Skype for Business and Lync Denial of Service Vulnerability
Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.
Other sources
Skype for Business and Lync Denial of Service Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.2046.879Patch KB5123287 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.9319.885Patch KB5123301 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.2046.569Patch KB5123300
Event History
Frequently Asked Questions
Which deployments are affected?
Affected products are Microsoft Skype for Business Server Subscription Edition CU1, Skype for Business Server 2019 CU8, and Skype for Business Server 2015 CU13.
Does exploitation require authentication or user interaction?
No. The vulnerability is network-accessible and the supplied vector indicates that an attacker does not need privileges or user interaction.
What is the expected impact of exploitation?
Successful exploitation can allow an unauthorized attacker to cause a denial of service. The supplied impact metrics indicate availability impact only, with no stated confidentiality or integrity impact.