Code execution via attacker-controlled Word file path

External path control in Microsoft Office Word allows attackers to execute code locally after a user opens a crafted document. Microsoft identifies external control of a filename or path but has not disclosed the affected function or the unsafe path operation. Exploitation requires user interaction and runs code in the user's security context, permitting data access, modification, or service interruption within that context.