Also uses a client side exploit in Word/Wordpad, although that was patched earlier this month:

https://portal.msrc.microsoft.com/en-US/security-guidance/ad...

Moronic design of the microsoft page. It requires you to acknowledge some bullshit T&C on first visit, then redirects you to the website home page. Which means that someone clicking on the CVE to check if there is anything important will be redirected to a home page with no information. Most sane people will go back to the original link, but if there were only sane people in this world, this second wave of malware would be toothless. That's not exactly helping awareness of the vulnerability.