CVE-2026-66308: Skype for Business and Lync Denial of Service Vulnerability
Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network.
Other sources
Skype for Business and Lync Denial of Service Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.2046.569Patch KB5123300 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.9319.885Patch KB5123301 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.2046.879Patch KB5123287
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be authorized and can exploit the flaw over the network. No user interaction is required.
What is the expected impact if exploitation succeeds?
Successful exploitation can deny service. The provided impact metrics indicate no confidentiality or integrity impact.
Which deployments are identified as affected?
The listed affected software includes Microsoft Skype for Business Server 2019 CU8, Microsoft Skype for Business Server 2015 CU13, and Microsoft Skype for Business Server Subscription Edition CU1.