This vulnerability (CVE-2026-33822) involves an out-of-bounds read in Microsoft Office Word as part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to read memory outside the intended bounds, potentially disclosing sensitive information locally. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity. Microsoft has released an official fix for this issue. Since Microsoft 365 Apps for Enterprise is a cloud service, remediation is managed by Microsoft. No known exploits are reported in the wild at this time.

An attacker can cause an out-of-bounds read that may lead to local information disclosure. There is no indication of integrity or availability impact beyond the out-of-bounds read. The vulnerability requires local access and user interaction to exploit.

An official fix is available from Microsoft. Because Microsoft 365 Apps for Enterprise is a cloud service, Microsoft manages the remediation process. Users and administrators should ensure their Microsoft 365 Apps are updated according to Microsoft's guidance in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33822.