This vulnerability (CVE-2026-33115) is a use-after-free flaw (CWE-416) in Microsoft Office Word component of Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to execute code locally on the affected system. The CVSS 3.1 base score is 8.4, indicating high severity, with attack vector local, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability with high impact. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The affected version explicitly includes 16.0.1. No known active exploitation has been reported.

Successful exploitation allows an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 8.4. No known exploits are currently active in the wild.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33115 to mitigate this vulnerability.