Microsoft 365 Apps For Enterprise CVE-2026-33115

The attacker must have local access to the Windows system running Microsoft Office Word. No user privileges required. No victim interaction needed — exploitation occurs automatically upon processing a malicious file or memory state.

The CVSS 8.4 score reflects high severity, driven by the combination of no required privileges (PR:N), no user interaction (UI:N), and complete system compromise potential (C:H/I:H/A:H). However, the local attack vector (AV:L) significantly constrains real-world exploitation scenarios-an attacker must already have local system access or convince a user to open a malicious document from a local file system. The low attack complexity (AC:L) indicates reliable exploitation once the malicious file is processed. Without EPSS data, exploitation probability remains theoretical, but the use-after-free primitive is well-understood by exploit developers and commonly targeted in memory corruption research. The absence of confirmed active exploitation (no KEV listing) and no public exploit code reduces immediate urgency compared to remotely exploitable vulnerabilities. The SSVC framework would likely classify this as 'scheduled' priority rather than 'immediate' for most organizations, unless users routinely process untrusted Office documents from external sources. The denial-of-service tag suggests reliability issues during exploitation attempts may cause application crashes before successful code execution, further reducing practical risk. Patch availability from Microsoft's official security update channel enables straightforward remediation, making this a manageable risk for organizations with functional patch management programs.

An attacker crafts a malicious Word document (.docx or .doc) containing specially formatted objects that trigger the use-after-free condition during parsing. When a user opens the document locally-either from email attachment saved to disk, USB drive, network share, or cloud storage synchronized to the local filesystem-Word processes the malformed structures, freeing memory while retaining active pointers. The attacker's payload manipulates heap layout to control the freed memory region, redirecting execution to embedded shellcode that runs with the privileges of the Word process, typically the logged-in user. No public exploit code exists, but the low complexity rating suggests skilled attackers could develop reliable exploits given the detailed vulnerability class and affected component information.