EIP-2026-118825

PRE-CVE

Microsoft Internet Explorer 6 - Codebase Double Backslash Local Zone File Execution

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-118825. PoCs published by Liu Die Yu.

AI-analyzed exploit summary The document describes a vulnerability in Internet Explorer where HTML documents can access local resources by prepending two backslashes to the resource path in the CODEBASE object property. This requires exploitation in the Local Zone, often chained with other vulnerabilities for arbitrary code execution.

Description

Microsoft Internet Explorer 6 - Codebase Double Backslash Local Zone File Execution

Exploits (1)

exploitdb WRITEUP VERIFIED
by Liu Die Yu · textremotewindows
https://www.exploit-db.com/exploits/24117

The document describes a vulnerability in Internet Explorer where HTML documents can access local resources by prepending two backslashes to the resource path in the CODEBASE object property. This requires exploitation in the Local Zone, often chained with other vulnerabilities for arbitrary code execution.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: Internet Explorer (version not specified)
No auth needed
Prerequisites: Access to Local Zone · Chaining with other vulnerabilities (e.g., BIDs 9658, 9320, 9105, 9107)
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026