EIP-2026-118745

This exploit targets a SEH-based buffer overflow in MailCarrier 2.51's POP3 LIST command, delivering a Meterpreter bind shell payload. It leverages a known return address in msjet40.dll to bypass DEP and ASLR.