Apparently, the word causes a fault when we create a malformed file in the following way.

It creates a new file word and he inserts a "wordart" which completely stuffed with letters "A", then we open a hex editor ubicamos where are the letters "A" for the "wordart" and overwrites until much further down exactly from the direction 000014E0 to 00002A80.

I leave a proof of concept

es.geocities.com/jplopezy/prueba.doc


Juan Pablo Lopez Yacubian
fuzzertina.blogspot.com