This vulnerability, identified as CVE-2026-33095 and classified under CWE-416 (Use After Free), affects Microsoft Office Word in Microsoft 365 Apps for Enterprise. It allows local code execution by an unauthorized attacker due to improper handling of memory after it has been freed. The CVSS 3.1 base score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability requires low privileges and user interaction but has low attack complexity. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

Successful exploitation could allow an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability requires user interaction but no privileges, making it a significant risk if exploited.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33095 to mitigate this vulnerability.