CVE-2026-33095 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office and Microsoft 365 Apps for Enterprise deployments should assess exposure and apply patches. They should also inventory and monitor installations for potential exposure and implement compensating controls to detect and prevent suspicious activity related to Microsoft Word. Additionally, security teams and vulnerability management teams should prioritize patching and review 3

Why it matters

CVE-2026-33095 is a high-severity vulnerability in Microsoft Word that allows an unauthorized attacker to execute code locally. Defenders should prioritize patching and monitoring to prevent potential exploitation.

• Verify and apply patches to prevent local code execution
• Inventory and monitor Microsoft Office and Microsoft 365 Apps for Enterprise installations for potential exposure
• Implement compensating controls to detect and prevent suspicious activity related to Microsoft Word

Technical summary

A use-after-free vulnerability in Microsoft Office Word allows an unauthorized attacker to execute code locally. The vulnerability is identified as CVE-2026-33095 and has a CVSS score of 7.8, indicating high severity. The vulnerability affects Microsoft Office Word and potentially allows attackers to exploit it for local code execution. There is no information on the root cause or specific exploit details.

Defensive priority

High

Recommended defensive actions

• Review and apply Microsoft's patch for CVE-2026-33095
• Inventory Microsoft Office and Microsoft 365 Apps for Enterprise installations to identify potential exposure
• Monitor for suspicious activity related to Microsoft Word

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but limited information is available on exploitation or impact. The vulnerability is identified as a use-after-free issue in Microsoft Office Word, which could allow an unauthorized attacker to execute code locally. There is no information on known or reported exploitation. Defenders should verify affected product deployments and apply patches accordingly.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.