EIP-2026-117562

This advisory details a vulnerability in Microsoft Windows .CONTACT files where HTML injection in the E-mail field allows arbitrary code execution via crafted 'mailto:' links. The exploit leverages lack of input validation to execute local executables when the user clicks the link.