Dissecting a complex vulnerability and achieving arbitrary code execution in Ichitaro Word

https://blog.talosintelligence.com/exploiting-low-severity-vulnerability-using-a-frame-pointer-overwrite/