This vulnerability (CVE-2026-33095) is a use-after-free issue classified under CWE-416 affecting Microsoft Office Word in Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally, potentially leading to full compromise of confidentiality, integrity, and availability. The CVSS 3.1 score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and complete impact on confidentiality, integrity, and availability. Microsoft has issued an official fix and manages remediation for this cloud service. The affected version explicitly includes 16.0.1.

Successful exploitation allows an unauthorized attacker to execute arbitrary code locally on the affected system, resulting in complete compromise of confidentiality, integrity, and availability of the impacted Microsoft 365 Apps for Enterprise environment. This can lead to full control over the affected application and potentially the host system.

An official fix is available from Microsoft. Users and administrators should apply the provided update to Microsoft 365 Apps for Enterprise to remediate this vulnerability. Since this is a cloud-hosted service, Microsoft manages remediation server-side; verify the vendor advisory for current patch status and deployment details.