This vulnerability (CVE-2026-33095) is a use-after-free issue (CWE-416) in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise version 16.0.1. It allows an unauthorized attacker to execute code locally by exploiting improper memory handling. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and full impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system. However, exploitation requires local access and user interaction. No active exploitation has been reported.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33095. Since this is a cloud service, Microsoft manages remediation server-side, but clients should ensure their Microsoft 365 Apps for Enterprise installations are updated to the fixed version. No additional mitigation steps are indicated by the vendor.