EIP-2026-117490

The document provides a detailed technical analysis of a double-free vulnerability in Microsoft Fax Cover Page Editor (fxscover.exe) affecting versions <= 5.2.3790.3959. It explains the root cause involving a 16-bit field used to index 'Text' elements, which can be manipulated to trigger a double-free condition during object deallocation, potentially leading to code execution.