The NIST database holds records for Microsoft Office vulnerabilities, however it only lists the application (i.e. Word 2016) and the service pack. Microsoft release hotfixes outside of service packs, therefore the NIST data alone isn't enough to tell if an installation of Office is vulnerable or not.
For example CVE-2019-1201:
which can be patched in Word 2016 with the 4475540 update.
The Word executable has a build number, such as 16.0.4229.1024, is there any way to use this build number to identify what vulnerabilities exist or have already been patched?
For example, I'd like to replicate the behaviour NIST has for Adobe, where all versions up to a build number are specified, such as CVE-2018-4890
Up to (including) 17.011.30070