EIP-2026-118822

PRE-CVE

Microsoft Internet Explorer 6 - ADODB.Stream Object File Installation

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-118822. PoCs published by Jelmer.

AI-analyzed exploit summary This exploit leverages the ADODB.Stream ActiveX object in Internet Explorer to write arbitrary files to the victim's filesystem when executed in a relaxed security zone (e.g., Local Zone). It demonstrates file overwrite capabilities, such as replacing wmplayer.exe, by fetching a remote payload and saving it locally.

Description

Microsoft Internet Explorer 6 - ADODB.Stream Object File Installation

Exploits (1)

exploitdb WORKING POC VERIFIED
by Jelmer · textremotewindows
https://www.exploit-db.com/exploits/24187

This exploit leverages the ADODB.Stream ActiveX object in Internet Explorer to write arbitrary files to the victim's filesystem when executed in a relaxed security zone (e.g., Local Zone). It demonstrates file overwrite capabilities, such as replacing wmplayer.exe, by fetching a remote payload and saving it locally.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Microsoft Internet Explorer (versions affected by relaxed Local Zone security restrictions)
No auth needed
Prerequisites: Victim must execute the script in a relaxed security zone (e.g., Local Zone or Intranet Zone) · Attacker must host a malicious payload on a remote server
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026