EIP-2026-117502

This exploit demonstrates an XXE (XML External Entity) vulnerability in Microsoft Windows MSINFO32.exe, allowing remote attackers to exfiltrate files from the victim's system by crafting a malicious .nfo file. The PoC includes a DTD file and a malicious .nfo file that, when opened, sends the contents of a target file to an attacker-controlled server.