CVE-2026-33115 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office applications, especially in environments where Microsoft Word is frequently used or exposed to untrusted documents, should prioritize patching vulnerable applications.

Why it matters

CVE-2026-33115 is a high-severity vulnerability in Microsoft Word that allows remote code execution. Defenders should prioritize patching vulnerable applications, especially in environments where Microsoft Word is frequently used or exposed to untrusted documents. The vulnerability has a CVSS score of 8.4, indicating a high severity vulnerability. However, there is no information on known exploitation or ransomware campaign use.

• Potential local code execution by unauthorized attackers
• Increased risk of lateral movement within compromised networks
• Possible data breaches or unauthorized access to sensitive information
• Required verification of affected versions and remediation efforts

Technical summary

The vulnerability is caused by a use-after-free in Microsoft Office Word, allowing an unauthorized attacker to execute code locally. Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and their Mac counterparts.

Defensive priority

Defenders should prioritize patching vulnerable Microsoft Office applications, especially in environments where Microsoft Word is frequently used or exposed to untrusted documents.

Recommended defensive actions

• Patch vulnerable Microsoft Office applications
• Restrict access to untrusted documents in Microsoft Word
• Monitor for suspicious activity in Microsoft Office applications

Evidence notes

The CVE record and source item provide details on the vulnerability, but do not specify any known exploitation or ransomware campaign use. The CVSS score is 8.4, indicating a high severity vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.