This vulnerability (CVE-2026-33095) is classified as CWE-416 (Use After Free) affecting Microsoft Office Word in Microsoft 365 Apps for Enterprise version 16.0.1. It enables an unauthorized attacker to execute code locally by exploiting a use-after-free condition. The CVSS v3.1 score is 7.8, indicating high severity with attack vector local, low attack complexity, no privileges required, but user interaction needed. The vulnerability impacts confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service, as detailed in their security update guide.

Successful exploitation allows an attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the impacted environment. The vulnerability requires user interaction but no privileges or authentication. There are no known exploits in the wild currently.

An official fix is available from Microsoft and should be applied promptly. Since this is a cloud-hosted service, Microsoft manages the remediation on their side. Users and administrators should follow guidance in the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33095 to ensure their environments are updated. No additional mitigation actions are specified by the vendor.