EIP-2026-117544

The exploit leverages the .xrm-ms file type to inject an XML stylesheet with a UNC path, forcing an outbound connection to an attacker-controlled server and leaking the target's NTLM hash. It requires user interaction to open the file but bypasses common security mechanisms like MOTW and email inspections.