Hackers are exploiting an unpatched vulnerability in Microsoft Word that could allow them to take control of a victim's PC.

That's according to security company Symantec, which has said that the zero-day vulnerability is the fourth in Microsoft's Word 2000 software that has not yet been patched.

Danish security vendor Secunia also reported the vulnerability, and rated it as "extremely critical," its highest-level warning.

The attack comes via an infected Word document, a method increasingly used by hackers for targeted attacks. If the document is opened, it installs a Trojan horse program, called Trojan.Mdropper.W, onto the computer, Lau wrote. The Trojan also puts other files on a computer that enable a hacker to control it.

Microsoft could not be immediately reached for comment. The company released three sets of critical patches on 9 January, including ones for Outlook, PowerPoint and Windows, but not for Word.

Users can avoid trouble by not opening unexpected Word documents attached to e-mail. Hackers often spam out thousands of messages with harmful attachments, such as Trojan horse programs, hoping unsuspecting victims will open them.

Trojans often look harmless and can quietly install themselves on a computer with no visible signs. The use of Word to mount an attack can be particularly effective since the file format is so widely used.