This vulnerability (CVE-2026-33822) involves an out-of-bounds read (CWE-125) in Microsoft Office Word as part of Microsoft 365 Apps for Enterprise version 16.0.1. The issue permits an unauthorized attacker to read memory beyond intended boundaries, potentially disclosing local information. The CVSS 3.1 base score is 6.1, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, and required user interaction. The vulnerability impacts confidentiality but not integrity, and causes high availability impact. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits have been reported.

An attacker can exploit this vulnerability to perform an out-of-bounds read in Microsoft Word, leading to local information disclosure. The impact is limited to confidentiality loss of local data. There is no indication of integrity compromise. The attack requires local access and user interaction. Availability impact is rated high, possibly due to application crash or denial of service conditions caused by the out-of-bounds read.

An official fix is available from Microsoft for this vulnerability. Since Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated to the latest patched version as per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33822. No additional mitigation actions are indicated by the vendor advisory.