Macro-less Code Exec in MSWord

This report describes how Dynamic Data Exchange (DDE) fields in Microsoft Word (using DDEAUTO/DDE) can be leveraged to execute arbitrary commands—such as cmd.exe and PowerShell—without macros, details steps to craft such documents and enable auto-updates via settings.xml, demonstrates PoC payloads and user prompts, and includes a disclosure timeline indicating Microsoft considered the behavior intended functionality.