Can a Word document contain a virus?
A .docx does not support embedded VBA macros, but it can still lead to code execution through embedded objects, remote templates, or parser exploits. Word documents remain one of the most common malware carriers; treat unexpected Office attachments as untrusted.
How a .DOCX file can do harm
- VBA macros, in .docm (and .doc) files, which run when enabled and can download and launch anything; Microsoft now blocks macros in files from the internet by default
- Embedded OLE objects: an executable or script packaged inside the document that runs when double-clicked
- Remote template injection: a harmless-looking .docx that loads a macro-enabled template from a URL when opened
- Exploits for Office parsing bugs in equation editors, fonts or images; patched versions are rarely vulnerable
- Links and QR codes to phishing pages
What it cannot do
- Run macros from a .docx file; the x in the extension means macro-free, and Word refuses to execute macros stored in one
- Do anything while Protected View is on, which is how Word opens downloads and attachments
Signs of a suspicious .DOCX file
- A yellow or red bar asking you to 'Enable Content' or 'Enable Editing' to see the document; legitimate documents are readable without it
- A page that is blank or blurred apart from instructions to enable macros
- A .docm, .doc or .dotm attachment when a .docx would do
- Unexpected invoices, résumés, delivery notes, or 'shared document' notifications
- The detector reports a ZIP, HTML or executable rather than DOCX
Before you open it
- Never click Enable Content on a document you were not expecting; macros are almost never required to read a file
- Leave Protected View on, and open attachments in it or in Word Online, which cannot run macros at all
- Keep Office updated; most Office exploits in the wild target old versions
- Ask the sender, through a channel you already have, whether they sent it
- Inspect the ZIP: a .docx with vbaProject.bin inside has been mislabelled and contains macros
Check that it really is a .DOCX file
The first question for any suspicious file is whether it is what its name says. Drop it on the detector: it reads the bytes in your browser, reports the real type, and computes the SHA-256 you can look up on VirusTotal, all without the file leaving your machine. A common DOCX signature is 50 4B 03 04 (PK..); see the signature reference.