https://bac-pac.org/index.php/2017/10/12/ms-office-built-in-feature-allows-malware-execution-without-macros-enabled/