Multiple Windows and Office products from Microsoft have an unpatched zero-day vulnerability that has been actively used in the wild. Nation-state actors and hackers used the vulnerability, catalogued as CVE-2023-36884, to acquire remote code execution through errant Office documents.