QID 92038

Microsoft is investigating reports of a series of remote code execution vulnerabilities impacting Windows and Office products. Microsoft is aware of targeted attacks that attempt to exploit these vulnerabilities by using specially-crafted Microsoft Office documents.

QID Detection Logic (Authenticated):
Detection checks for the registry "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION" and the following application names to this registry key as values of type REG_DWORD with data 1. Excel.exe
Graph.exe
MSAccess.exe
MSPub.exe
PowerPnt.exe
Visio.exe
WinProj.exe
WinWord.exe
Wordpad.exe

An attacker can create a specially crafted Microsoft Office document that enables them to perform remote code execution in the context of the victim. However, an attacker would have to convince the victim to open the malicious file.