This vulnerability (CVE-2026-33115) is a use-after-free flaw (CWE-416) in Microsoft Office Word as part of Microsoft 365 Apps for Enterprise. It enables unauthorized local code execution by exploiting improper memory handling. The CVSS 3.1 base score is 8.4 (high severity) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating local attack vector with low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability affects version 16.0.1. Microsoft has released an official fix and manages remediation for this cloud service. The vendor advisory is available at the Microsoft Security Response Center.

Successful exploitation allows an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. This could enable an attacker to run malicious code with the privileges of the user running Microsoft Word.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33115 to mitigate this vulnerability.