Outlook 2000 and 2003 allow execution of remote web pages specified within the data property of OBJECT tags when there is no closing /OBJECT tag, while forwarding an HTML email message using Word 2000 or 2003 as the email editor. This behavior happens regardless of Security Zone settings.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/33748/mswordEmail.txt
Source: https://packetstormsecurity.com/files/33748/mswordEmail.txt.html