What causes the vulnerability in Word?
The vulnerability occurs because Word does not check the template for embedded macros when you open a Rich Text Format document that is linked to a Word template. When Word is used to open an RTF file that contains a link to a template, only the RTF file is checked for macros. The template, which might also contain macros, is not checked.