EIP-2026-117011

This exploit leverages the `SetPeLauncherState` method in the `CG6Service` service to replace the sticky keys executable (`sethc.exe`) with `cmd.exe`, allowing privilege escalation via a logout and 5x SHIFT key press.