[wffurr]

There were, eg in Outlook: https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

There probably still are and it’s possibly some three letter agencies or bad actors know about them.