This vulnerability, tracked as CVE-2026-33114 and classified under CWE-822 (Untrusted Pointer Dereference), affects Microsoft Office Word within Microsoft 365 Apps for Enterprise version 16.0.1. It allows an attacker to execute code locally by exploiting improper handling of pointers. The CVSS v3.1 base score is 8.4, indicating a high severity with local attack vector, low complexity, no privileges required, and no user interaction needed. Microsoft has published an official fix and manages remediation for this cloud service. No known active exploitation has been reported.

Successful exploitation of this vulnerability could result in local code execution with high impact on confidentiality, integrity, and availability of the affected system. Because the attack vector is local and requires no privileges or user interaction, it poses a significant risk if an attacker gains local access. However, there are no known exploits in the wild currently.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated to the latest patched version as per the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33114. No additional mitigation steps are indicated by the vendor.