CVE-2026-33115 is a use-after-free vulnerability (CWE-416) in Microsoft Office Word component of Microsoft 365 Apps for Enterprise version 16.0.1. This vulnerability enables an unauthorized attacker to execute arbitrary code locally by exploiting improper memory handling. The CVSS v3.1 base score is 8.4, indicating high severity with impact on confidentiality, integrity, and availability. Microsoft has issued an official patch to remediate this vulnerability. The product is cloud-hosted, and Microsoft manages remediation for this service. No active exploitation has been reported.

Successful exploitation of this vulnerability allows an unauthorized attacker to execute code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system running Microsoft 365 Apps for Enterprise version 16.0.1. There are no reports of known exploits in the wild currently.

An official fix is available from Microsoft. Users and administrators should apply the provided patch as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33115. Since this is a cloud-hosted service, Microsoft manages remediation for the cloud environment. Verify that your environment is updated to the fixed version to mitigate this vulnerability.