Hot on the heels of three recent Microsoft Office Word vulnerabilities that are still unpatched from December 2006, comes another zero-day Word Unspecified Code Execution vulnerability. At the time of this article, there was no response from Microsoft on any of the official channels in relation to the new zero-day.

"The vulnerability is caused due to an unspecified error when parsing Word documents and can be exploited to execute arbitrary code on the user's system," reveals Secunia, additionally informing that the vulnerability is being actively exploited.

Secunia has also attributed an Extremely Critical security risk to the Word Unspecified Code Execution vulnerability. The zero-day has been confirmed to impact Word 2000, but other versions of Word may also be affected. The Trojan.Mdropper.W Trojan horse has already been correlated with the exploits of the new Word zero-day.

"We've seen many threats using vulnerabilities based on Microsoft Office documents over the last year, so it's no surprise that we have recently observed new samples of a threat that follows the same theme. This threat named Trojan.Mdropper.W is using the new Microsoft Word 2000 Unspecified Code Execution Vulnerability to drop threats onto a compromised computer," explained Hon Lau / Sr. Security Response Engineer at Symantec.

Potential victims can get infected via social engineering. Users must open an infected Word document in order to compromise their system. "When the infected Word document is opened, it uses an exploit to drop some files onto the computer. These files are back door Trojans that enable an attacker to gain remote access to your computer," added Hon Lau.