## 1 Introduction
### Threat Assessment of Microsoft Office Documents  
The anti-virus provider Kaspersky [5] collected data on the applications that are most frequently targeted and, as a consequence, have the highest block record in their software. As illustrated in Figure 1, Microsoft Office is the most targeted application, representing over 66% of all attacks, while browser attacks account for only 21.70%. This demonstratesthat an active vulnerability is particularly damaging, as it is more likely to be exploited than, for instance, a PDF vulnerability. This is simply because it is a more popular target.  
CVE (Common Vulnerabilities and Exposures) is a knowledge base that catalogues publicly disclosed security flaws. It aggregates vulnerability data so that people or tools can refer to the same vulnerability by a CVE ID, which is made up of the letters CVE, the year of discovery and a unique identifier, for example, \"CVE-2023-33131\" Microsoft Outlook Remote Code Execution Vulnerability, which involves a Word file containing malicious code. Further details can be found in [6]. This is often associated with the CVSS (Common Vulnerability Scoring System), which helps to assess the severity of a vulnerability by assigning it a number between 0.0, low severity, to 10.0, high severity. The CVE-2023-33131 has a CVSS rating of 8.8, which assigns it a severity of HIGH. The CVE database documents 664 security vulnerabilities in Microsoft Office that have at least a CVSS rating of HIGH (\(\geq\)7), of which 468 have a rating of CRITICAL (\(\geq\)9). The distribution of these by year is shown in Figure 2.  
Nevertheless, it should be noted that attack vectors do not necessarily originate in a software flaw. Indeed, typical social engineering tactics are also applicable. As with conventional email, malicious actors may display a Quick Response (QR) code that redirects to a phishing website or obfuscate a link to make it appear as though it redirects to a different web address. Despite the ease with which the link can be deobfuscated by hovering the  
Figure 1: Distribution of exploits used in attacks by attacked application type, May 2020-April 2021 [5].  
Figure 2: Newly published CVEs with a CVSS score of \(\geq\)7 by year [7].  
cursor over it, this is seldom performed due to the vast number of links that employees are exposed to on a daily basis. A computer program has the advantage that it cannot be manipulated by the visual appearance and can therefore assess the underlying code, just like any other document aspect.  
As we have seen, many high-severity Office vulnerabilities have been added over the last few decades. Microsoft Office remains a very attractive target for attackers and can be exploited through application vulnerabilities or common social engineering techniques. The evidence indicates that Microsoft Office documents have historically exhibited significant security vulnerabilities that persist to the present day, increasing the likelihood of their exploitation by malicious actors. In the next Section 1.4, we examine the ways in which the aforementioned vulnerabilities can be exploited once a malicious document has been accessed by a victim.