CVE-2026-33822: 
vulnerability analysis and mitigation

CVE-2026-33822 is an out-of-bounds read vulnerability in Microsoft Office Word that allows an unauthorized attacker to disclose information locally. It was disclosed and patched on April 14, 2026, as part of Microsoft's April 2026 Patch Tuesday security update cycle. Affected products include Microsoft 365 Apps for Enterprise (x86 and x64), Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium), as assigned by Microsoft (Microsoft MSRC, Github Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read), meaning the application reads data beyond the intended buffer boundary when processing a malicious Word document. The attack vector is local, requiring no privileges but necessitating user interaction — specifically, a victim must open a specially crafted Word document. Exploitation of this flaw can trigger both information disclosure (low confidentiality impact) and a denial-of-service condition (high availability impact), while integrity is unaffected. No public technical write-ups or proof-of-concept code have been identified (Microsoft MSRC, Github Advisory).

Successful exploitation could allow an attacker to read sensitive memory contents from the affected process, potentially disclosing confidential information stored in memory, and could also cause the application to crash, resulting in a denial-of-service condition. The attack is constrained to the local system and requires the victim to open a malicious Word document, limiting the scope to the affected application without privilege escalation or lateral movement potential. No integrity impact has been identified (Microsoft MSRC).

As of the time of disclosure, there is no evidence of active in-the-wild exploitation and no public proof-of-concept exploit has been observed (Microsoft MSRC). The EPSS score is approximately 0.047% (0.000470), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft a malicious Word document: An attacker creates a specially crafted .docx or .doc file designed to trigger an out-of-bounds read when parsed by Microsoft Office Word.
2. Deliver the document: The attacker distributes the malicious file via phishing email, malicious download link, or other social engineering methods targeting users running affected versions of Microsoft 365 Apps or Office LTSC for Mac.
3. Victim opens the document: The attack requires user interaction — the victim must open the malicious document in an affected version of Microsoft Office Word.
4. Trigger out-of-bounds read: Upon opening, the Word parser reads beyond the intended buffer boundary, potentially exposing memory contents or causing an application crash.
5. Achieve objective: The attacker may obtain sensitive information from process memory (information disclosure) or cause the application to crash (denial of service) (Microsoft MSRC, Github Advisory).

• File System: Unexpected or suspicious .docx/.doc files received via email or downloaded from untrusted sources; files with unusual metadata or embedded objects.
• Logs: Application crash logs or Windows Error Reporting entries referencing WINWORD.EXE with access violation or out-of-bounds memory read errors; Office telemetry logs showing abnormal document parsing events.
• Process: Microsoft Word (WINWORD.EXE) crashing unexpectedly or terminating with an unhandled exception shortly after opening a document; unusual memory access patterns in Office process monitoring.

Microsoft released patches on April 14, 2026 as part of the April 2026 Patch Tuesday update. Organizations should update to the following patched versions: Microsoft 365 Apps for Enterprise (version 16.0.1 or later via Microsoft Update), Microsoft Office LTSC for Mac 2024 (version 16.108.26041219 or later), and Microsoft Office LTSC for Mac 2021 (version 16.108.26041219 or later). As interim mitigations, organizations should train users to avoid opening Word documents from untrusted or unexpected sources, and consider applying application sandboxing or restricted access controls for Office applications in high-security environments (Microsoft MSRC).

The vulnerability was covered as part of broader April 2026 Patch Tuesday roundups. BleepingComputer reported on the overall April 2026 Patch Tuesday release, which addressed 167 flaws including two zero-days, with CVE-2026-33822 noted among the Office-related fixes. Zero Day Initiative (ZDI) also published an April 2026 security update review covering the release. Coverage was largely routine, with no significant community alarm given the medium severity rating and lack of active exploitation.