EIP-2026-119659

This exploit demonstrates an XML External Entity (XXE) injection vulnerability in Microsoft Excel 2016 v1901. By crafting a malicious XML file and leveraging the 'Import as HTML page' functionality, an attacker can exfiltrate local data to a remote server.