EIP-2026-103540

This exploit leverages a vulnerability in macOS/iOS QuickLook's OfficeImport framework, where font names in Office files are not properly sanitized, allowing arbitrary JavaScript injection. The PoC demonstrates this by embedding a script tag within a font name in a DOCX file, which executes when previewed via QuickLook.