This vulnerability (CVE-2026-33114) is classified as CWE-822: Untrusted Pointer Dereference in Microsoft Office Word within Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to execute code locally by exploiting improper handling of pointer dereferences. The CVSS v3.1 score is 8.4, indicating high impact on confidentiality, integrity, and availability. The affected version explicitly stated is 16.0.1. Microsoft has released an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation could lead to local code execution by an unauthorized attacker, impacting confidentiality, integrity, and availability of the affected system. Since this is a local attack vector with low attack complexity and no user interaction required, it poses a significant risk if the vulnerable version is in use.

An official fix is available from Microsoft. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages the remediation for this vulnerability. Users and administrators should ensure their installations are updated to the fixed version as per the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33114.