CVE-2026-66307: Skype for Business DOS Vulnerability

CVE-2026-66307 Overview

CVE-2026-66307 is an integer underflow (wrap or wraparound) vulnerability in Microsoft Skype for Business. An unauthorized remote attacker can trigger the flaw over a network to cause a denial-of-service condition. The weakness is classified under CWE-191: Integer Underflow (Wrap or Wraparound).

The vulnerability requires no authentication and no user interaction. Successful exploitation disrupts availability of the Skype for Business service, impacting real-time communication for affected organizations.

Critical Impact
A remote, unauthenticated attacker can send crafted network traffic that causes integer wraparound in Skype for Business, resulting in service disruption for all users of the affected server.

Affected Products

Microsoft Skype for Business (see the Microsoft Security Update Guide for the full list of impacted builds)

Discovery Timeline

2026-09-08 - CVE-2026-66307 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-66307

Vulnerability Analysis

The vulnerability resides in Skype for Business network message processing logic. An integer underflow occurs when arithmetic on an unsigned value drops below zero and wraps to a large positive number. This produces incorrect length or offset calculations downstream.

When the wrapped value is used to size a buffer, index into memory, or drive a processing loop, the service enters an inconsistent state. In this case the outcome is loss of availability rather than memory corruption or information disclosure. The impact is limited to a denial-of-service condition against the Skype for Business service.

Root Cause

The root cause is missing or insufficient validation of untrusted length or size fields prior to arithmetic operations. [CWE-191] flaws typically stem from subtracting a larger value from a smaller unsigned integer without a bounds check. Refer to the Microsoft Security Update Guide for vendor-specific technical detail.

Attack Vector

The attack vector is network-based with low complexity and no privileges required. A remote attacker crafts a malformed message that reaches the Skype for Business service and triggers the underflow during parsing. No user interaction is needed, and the attacker does not need a valid account on the target system.

No public proof-of-concept exploit and no exploit code are currently available. The Exploit Prediction Scoring System (EPSS) probability is 0.645%. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-66307

Indicators of Compromise

Unexpected crashes, restarts, or hangs of Skype for Business front-end or edge server processes
Malformed or oversized protocol messages arriving at Skype for Business listening ports from untrusted sources
Sudden loss of presence, messaging, or conferencing availability without corresponding change activity

Detection Strategies

Monitor Windows Event Logs and Skype for Business server logs for repeated service faults or watchdog restarts
Inspect SIP and related protocol traffic at network sensors for structurally invalid messages targeting Skype for Business
Correlate service availability alerts with inbound traffic spikes from single or small sets of source addresses

Monitoring Recommendations

Ingest Skype for Business server telemetry, Windows event data, and perimeter logs into a centralized analytics platform
Baseline normal SIP message rates and alert on statistical deviations that coincide with service degradation
Alert on process crashes for Skype for Business services and trigger automated triage workflows

How to Mitigate CVE-2026-66307

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all Skype for Business servers
Inventory all Skype for Business front-end, edge, and mediation servers and confirm patch coverage
Restrict network exposure of Skype for Business services to trusted networks where operationally feasible

Patch Information

Microsoft has issued a security update for CVE-2026-66307. Administrators should consult the Microsoft Security Update Guide for the specific KB articles, build numbers, and deployment guidance that correspond to their Skype for Business version.

Workarounds

Place Skype for Business edge services behind a session border controller or reverse proxy that validates SIP message structure
Apply network access control lists to limit inbound connections to known federation partners and clients
Enable rate limiting on perimeter devices to reduce the impact of repeated malformed message floods

bash

# Example: restrict inbound SIP traffic to trusted subnets on Windows Server
New-NetFirewallRule -DisplayName "Restrict SIP TLS to Trusted Subnets" \
  -Direction Inbound -Protocol TCP -LocalPort 5061 \
  -RemoteAddress 203.0.113.0/24,198.51.100.0/24 -Action Allow