Why attackers can still exploit a MS Office vulnerability patched in 2012