This vulnerability (CVE-2026-33114) is classified as CWE-822: Untrusted Pointer Dereference, occurring in Microsoft Office Word within Microsoft 365 Apps for Enterprise version 16.0.1. It allows an attacker to execute code locally by exploiting improper handling of pointers. The CVSS 3.1 base score is 8.4, indicating high severity, with attack vector local, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Microsoft has issued an official fix and manages remediation for this cloud-hosted service.

Successful exploitation could lead to local code execution by an unauthorized attacker, compromising confidentiality, integrity, and availability of the affected system. However, exploitation requires local access and no user interaction or privileges, which somewhat limits the attack surface. No known active exploits have been reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33114. No additional mitigation actions are currently required.