Microsoft has confirmed a new zero-day vulnerability affecting Word - the second in a week - as well as targeted exploits exploiting the flaw.