The correct action to take first is to apply the software patch provided by the vendor if one is available. Patch management is a critical security control that can mitigate vulnerabilities that have been discovered and addressed by the software provider. Installing a new antivirus in this case would not remove the existing vulnerability in the software, although it might provide some protection against malware that attempts to exploit the vulnerability. Changing the document format might avoid the vulnerability, but it is not a viable long-term solution and would likely disrupt normal business operations. Disabling internet access would prevent some exploitation attempts, but would not address the vulnerability itself and would likely disrupt business operations.