This vulnerability (CVE-2026-33114) is classified as CWE-822 (Untrusted Pointer Dereference) and affects Microsoft 365 Apps for Enterprise, particularly Microsoft Office Word. It allows an unauthorized attacker to execute code locally by exploiting improper handling of pointers. The CVSS 3.1 base score is 8.4, indicating high severity with local attack vector, low attack complexity, no privileges required, and no user interaction needed. Microsoft has published an official fix and manages remediation for this cloud service. No known active exploitation has been reported.

Successful exploitation could lead to local code execution with high impact on confidentiality, integrity, and availability of the affected system. This means an attacker could run arbitrary code on the victim's machine without requiring privileges or user interaction.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33114 for detailed patching and update instructions.