Microsoft 365 Apps For Enterprise CVE-2026-33822

The CVSS 6.1 score with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H reflects moderate real-world risk. Key signals: (1) Attack Vector Local (AV:L) significantly constrains threat surface - the attacker must have local file system access or convince a user to open a malicious document; (2) Low Complexity (AC:L) means exploitation is straightforward once a crafted document is delivered; (3) User Interaction Required (UI:R) is a meaningful gate, though social engineering can bypass it; (4) No integrity impact (I:N) and limited confidentiality impact (C:L) suggest the disclosure is narrow, likely not exposing sensitive secrets directly; however, the high availability impact (A:H) indicates the out-of-bounds read can crash Word or corrupt its state. EPSS and active exploitation status are not provided, so real-world prioritization depends on whether this is patched in enterprise deployments. For organizations with auto-updates enabled (Microsoft 365), risk is lower; for organizations running Office LTSC with slower patch cycles, this represents a meaningful insider-risk vector (malicious document distribution to local users).

An attacker crafts a malicious Word document (DOCX or DOC) containing specially formatted content that triggers an out-of-bounds read in Word's parser. The attacker distributes this document via email or file-sharing service to a target user. When the user opens the document (satisfying the UI:R requirement), Word's parser attempts to read document metadata or content structures, and due to missing bounds validation, reads beyond allocated buffer boundaries. This read discloses memory contents from the Word process (such as cached credentials, recent file paths, or encryption keys) to the attacker via observable Word behavior or crash logs, or causes Word to crash, disrupting the user's work (high availability impact).