EIP-2026-118822

This exploit leverages the ADODB.Stream ActiveX object in Internet Explorer to write arbitrary files to the victim's filesystem when executed in a relaxed security zone (e.g., Local Zone). It demonstrates file overwrite capabilities, such as replacing wmplayer.exe, by fetching a remote payload and saving it locally.