EIP-2026-116091

This exploit leverages an unsafe ActiveX control (PowerPoint Viewer OCX v3.1) to write an arbitrary file to the filesystem. The `Save` method is invoked via JavaScript to save a file to `c:\St_.exe`, demonstrating a potential arbitrary file write vulnerability.