Skype for Business and Lync Denial of Service Vulnerability
Impact
Skype for Business has an integer underflow vulnerability, allowing an unauthorized attacker to deny service over a network, affecting versions 9319.0 to 6.0.9319.885, 2046.0 to 7.0.2046.569, and 2046.0 to 7.0.2046.879.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Microsoft · microsoft
Skype for Business Server 2015 CU13
1 range
Microsoft · microsoft
Skype for Business Server 2015 CU13
Compare with this publisher’s ranges. This does not inspect your installation.
affected
9319.0 → before 6.0.9319.885
custom versions
Other versions: unknown
Microsoft · microsoft
Skype for Business Server 2019 CU8
1 range
Microsoft · microsoft
Skype for Business Server 2019 CU8
Compare with this publisher’s ranges. This does not inspect your installation.
affected
2046.0 → before 7.0.2046.569
custom versions
Other versions: unknown
Microsoft · microsoft
Skype for Business Server Subscription Edition CU1
1 range
Microsoft · microsoft
Skype for Business Server Subscription Edition CU1
Compare with this publisher’s ranges. This does not inspect your installation.
affected
2046.0 → before 7.0.2046.879
custom versions
Other versions: unknown
Original source description
Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-66307View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
microsoft · platform conditions
Any condition may hold
Vulnerable product
cpe:2.3:a:microsoft:skype_for_business_server_2015:*:cu13:*:*:*:*:*:*From (inclusive): 9319.0
Before: 6.0.9319.885
Vulnerable product
cpe:2.3:a:microsoft:skype_for_business_server_subscription_edition:*:cu1:*:*:*:*:*:*From (inclusive): 2046.0
Before: 7.0.2046.879
Vulnerable product
cpe:2.3:a:microsoft:skype_for_business_server_2019:*:cu8:*:*:*:*:*:*From (inclusive): 2046.0
Before: 7.0.2046.569
Original applicability statements
[
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server_2015:*:cu13:*:*:*:*:*:*",
"versionStartIncluding": "9319.0",
"versionEndExcluding": "6.0.9319.885"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server_subscription_edition:*:cu1:*:*:*:*:*:*",
"versionStartIncluding": "2046.0",
"versionEndExcluding": "7.0.2046.879"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:skype_for_business_server_2019:*:cu8:*:*:*:*:*:*",
"versionStartIncluding": "2046.0",
"versionEndExcluding": "7.0.2046.569"
}
]
}
]
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.