CVE-2026-33822 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office and Microsoft 365 Apps for Enterprise deployments should assess exposure and prioritize patching.

Why it matters

CVE-2026-33822 is a medium-severity vulnerability in Microsoft Word that allows local information disclosure. Defenders responsible for Microsoft Office and Microsoft 365 Apps for Enterprise deployments should assess exposure, prioritize patching, and monitor for potential information disclosure attempts. The vulnerability requires verification of affected products and potential impact, and patching is necessary to mitigate it.

• Defenders must assess exposure of Microsoft Office deployments to this information disclosure vulnerability
• Potential for local information disclosure requires verification and monitoring
• Patching is required to mitigate the vulnerability
• Inventory checks and compensating controls may be necessary for affected products

Technical summary

The vulnerability is an out-of-bounds read in Microsoft Office Word that allows an unauthorized attacker to disclose information locally. Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024.

Defensive priority

Medium priority for defenders to assess exposure and apply patches

Recommended defensive actions

• Assess exposure of Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024 to this vulnerability
• Apply patches from Microsoft as available
• Verify inventory of affected products and prioritize patching
• Monitor for potential information disclosure attempts

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation and impact is limited. The vulnerability affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Defenders should verify the affected products and their potential impact, and patching is necessary to mitigate it. There is no evidence of exploitation, but defenders should monitor for potential information disclosure

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.