Hackers exploited Word flaw for months while Microsoft investigated