CVE-2026-33095Patch(microsoft / 365_apps)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch microsoft 365_apps systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

microsoft CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33095

Weakness type (CWE)

CWE-416

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

365_apps
office_long_term_servicing_channel

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
General: 1 classified signal
Disclosure: 1 classified signal
Peaked 2d ago at 2 mentions (2026-04-14); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

microsoft

Products

365_appsoffice_long_term_servicing_channel

3 versions affected across 2 products

Deep dive

Activity timeline4 mentions / 3d

Signal classification3 categories

Patch

250.0%

General

125.0%

Disclosure

125.0%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-14	2	Patch2
2026-04-15	1	General1
2026-04-17	1	Disclosure1

Full discourse4 posts

Haifei Li@HaifeiLi177d
Patch
Today (Patch Tuesday) Microsoft patched three new Office bugs I recently discovered and reported: - Microsoft Word Remote Code Execution Vulnerability (CVE-2026-33095) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33095 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2026-32199) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32199 - Microsoft Word Remote Code Execution Vulnerability (CVE-2026-23657) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23657 More to come.:)
Post summary
The tweet announces Microsoft's patch of three Office RCE vulnerabilities, including patch links, but offers no PoC, exploit code, or evidence of active exploitation.
014088158.3K
8.9K followersView on X
CVE@CVEnew174d
Disclosure
CVE-2026-33095 Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. https://www.cve.org/CVERecord?id=CVE-2026-33095
Post summary
A newly disclosed CVE-2026-33095 vulnerability in Microsoft Office Word permits a use‑after‑free that leads to local code execution.
0000083
57.2K followersView on X
WindowsForum@windowsforum176d
General
🪟 CVE title says “RCE” but CVSS says “AV:L.” Translation: Windows security is basically legalese. It’s still bad—just the attacker has to trick you into opening the trap first. https://windowsforum.com/threads/why-office-rce-and-cvss-av-l-can-both-be-true-cve-2026-33095-explained.413463/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #RemoteCodeExecution #CvssAvL #MicrosoftOfficeSecurity #Cve202633095
Post summary
The post explains that CVE‑2026‑33095 is a remote code execution vulnerability rated as local access (CVSS AV:L), implying it requires user interaction, but provides no exploit, patch, or active exploitation details.
0000022
1.1K followersView on X
Red Hornet Intel@RedHornet_Intel177d
Patch
CVE-2026-33095 | Microsoft 365 Apps for Enterprise | Remote Code Execution Description Use-after-free vulnerability in Microsoft Office Word in Microsoft 365 Apps for Enterprise allows unauth attacker to achieve RCE locally by tricking user into opening malicious document. Severity: High Exploitation: Unknown Public PoC: Unknown Patch Available: Yes Affected Product: Microsoft 365 Apps for Enterprise Affected Version: >= 16.0.1 and < https://aka.ms/OfficeSecurityReleases Sources Vendor: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33095
Post summary
A high‑severity RCE in Microsoft 365 Apps for Enterprise via a use‑after‑free in Word is disclosed, with a patch available but no PoC or evidence of active exploitation reported.
0000050
8 followersView on X

CPE platform detail8 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

8 of 8 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	microsoft	365_apps	-	-	x64
App	microsoft	365_apps	-	-	x86
App	microsoft	office_long_term_servicing_channel	2021	-	x64
App	microsoft	office_long_term_servicing_channel	2021	-	x86
App	microsoft	office_long_term_servicing_channel	2021	macos	-
App	microsoft	office_long_term_servicing_channel	2024	-	x64
App	microsoft	office_long_term_servicing_channel	2024	-	x86
App	microsoft	office_long_term_servicing_channel	2024	macos	-

Explore more

Back to dashboard microsoft CVEs 365_apps vulnerabilities

What researchers are saying

CVE-2026-33095

WindowsForum[verified]@windowsforumGeneral

The post explains that CVE‑2026‑33095 is a remote code execution vulnerability rated as local access (CVSS AV:L), implying it requires user interaction, but provides no exploit, patch, or active exploitation details.

Red Hornet Intel[verified]@RedHornet_IntelPatch

A high‑severity RCE in Microsoft 365 Apps for Enterprise via a use‑after‑free in Word is disclosed, with a patch available but no PoC or evidence of active exploitation reported.

Haifei Li@HaifeiLiPatch

The tweet announces Microsoft's patch of three Office RCE vulnerabilities, including patch links, but offers no PoC, exploit code, or evidence of active exploitation.

CVE@CVEnewDisclosure

A newly disclosed CVE-2026-33095 vulnerability in Microsoft Office Word permits a use‑after‑free that leads to local code execution.