CVE-2026-33095: 
vulnerability analysis and mitigation

CVE-2026-33095 is a use-after-free vulnerability in Microsoft Office Word that allows an unauthorized attacker to execute code locally on affected systems. Disclosed on April 14, 2026, as part of Microsoft's April 2026 Patch Tuesday, it affects Microsoft Office 2021, Office 2024, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Microsoft 365 Apps for Enterprise. It carries a CVSS v3.1 base score of 7.8 (High) (Microsoft MSRC, GitHub Advisory).

The vulnerability is classified as CWE-416 (Use After Free), meaning Microsoft Office Word improperly reuses or references memory after it has been freed, potentially allowing an attacker to control the freed memory region and redirect code execution. Exploitation requires local access and user interaction — specifically, a victim must open a specially crafted malicious Word document. No privileges are required on the part of the attacker prior to exploitation. No public proof-of-concept or detailed technical write-up has been identified at this time (Microsoft MSRC, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running Microsoft Office Word, resulting in high impact to confidentiality, integrity, and availability of the affected system. An attacker could access sensitive data, modify files, install malware, or use the compromised system as a pivot point for lateral movement within a network. The scope is limited to the affected system (unchanged scope), but the combination of full CIA triad impact makes this a significant risk in enterprise environments (Microsoft MSRC).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.058–0.068%, placing it in roughly the 21st percentile for exploitation likelihood within 30 days. No threat actor attribution has been reported (GitHub Advisory, Microsoft MSRC).

1. Craft a malicious Word document: An attacker creates a specially crafted .docx or .doc file designed to trigger the use-after-free condition in Microsoft Office Word's memory management routines.
2. Deliver the document: The attacker distributes the malicious document via phishing email, malicious download link, or other social engineering methods targeting users of affected Office versions.
3. Victim opens the document: When the target user opens the file in a vulnerable version of Microsoft Office Word (Office 2021, 2024, LTSC variants, or Microsoft 365 Apps for Enterprise), the use-after-free condition is triggered.
4. Memory manipulation: The freed memory region is reallocated and controlled by the attacker's payload, redirecting execution flow to attacker-controlled code.
5. Code execution: Arbitrary code executes with the privileges of the logged-in user, enabling installation of malware, credential theft, data exfiltration, or further lateral movement within the network (Microsoft MSRC).

• Process: Unusual child processes spawned by WINWORD.EXE (e.g., cmd.exe, powershell.exe, wscript.exe, mshta.exe) shortly after a Word document is opened.
• File System: Unexpected files written to %TEMP%, %APPDATA%, or startup folders by the Word process; new or modified macros or templates in the Office user data directory.
• Network: Outbound connections from WINWORD.EXE to external or unusual IP addresses/domains, particularly following document open events.
• Logs: Windows Event Logs (Security/Application) showing process creation events with WINWORD.EXE as the parent process for unexpected executables; application crash logs or Dr. Watson/WER reports related to WINWORD.EXE memory access violations.

Microsoft released security updates on April 14, 2026 addressing this vulnerability for all affected products. Users should apply the latest cumulative Office updates via Microsoft Update or the Microsoft Update Catalog, referencing the official security release page at https://aka.ms/OfficeSecurityReleases. For Mac users, affected versions are those prior to 16.108.26041219 for both Office LTSC for Mac 2021 and 2024. Until patching is complete, organizations should exercise caution when opening Word documents from untrusted sources, consider implementing document scanning solutions, and apply application whitelisting where feasible (Microsoft MSRC).

CVE-2026-33095 was covered as part of broader reporting on Microsoft's April 2026 Patch Tuesday, which addressed 167 flaws in total. Security outlets including BleepingComputer and Computerworld highlighted the scale of the April 2026 update, while Zero Day Initiative (ZDI) published a security update review covering the release. Researcher Haifei Li was noted in social media activity related to the April 2026 Patch Tuesday disclosures. NSFOCUS and Security Boulevard also published high-risk vulnerability notices covering this CVE among others in the April update batch (BleepingComputer, ZDI Blog).