EIP-2026-117569

This exploit demonstrates a DLL hijacking vulnerability in Windows Live Email by providing a malicious dwmapi.dll that executes arbitrary code (calc.exe) when loaded. The vulnerable software loads the DLL from the current directory, allowing an attacker to place a malicious DLL in a directory with a .eml, .nws, or .rss file.