CVE-2026-33114 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Microsoft Office LTSC for Mac 2021/2024 should assess exposure and apply patches.

Why it matters

CVE-2026-33114 is a high-severity vulnerability in Microsoft Word that allows an unauthorized attacker to execute code locally. Defenders should assess exposure, apply patches, and monitor for suspicious activity.

• Verify and apply patches for affected Microsoft products to prevent local code execution
• Assess exposure of Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Microsoft Office LTSC for Mac 2021/2024
• Monitor for suspicious activity related to Microsoft Word

Technical summary

The vulnerability is caused by an untrusted pointer dereference in Microsoft Office Word, allowing an unauthorized attacker to execute code locally. This vulnerability has a high severity and affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Microsoft Office LTSC for Mac 2021/2024. The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or victim impact. Defenders should assess exposure and apply patches to prevent local code execution.

Defensive priority

High

Recommended defensive actions

• Review and apply Microsoft patches for affected products
• Inventory and assess exposure of Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Microsoft Office LTSC for Mac 2021/2024
• Monitor for suspicious activity related to Microsoft Word

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or victim impact. The vulnerability is caused by an untrusted pointer dereference in Microsoft Office Word, allowing an unauthorized attacker to execute code locally. There is no information on known or unknown affected scope, but defenders should verify and apply patches for affected Microsoft products to prevent local code execution. The official CVE Program and N

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.