Ie 0day exp-Windows WordPad HTML Help File Remote Execution Vulnerability

The chm help file can be called through ActiveX controls for information exchange. When we load the Help File abnormally, this vulnerability may occur.
Let's take a look at the simplest, safest, and most widely used Microsoft built-in program Notepad. You may not know the shard in the local disk and NetBIOS when a small txt file is opened, when users perform information interaction, if the file is shared in a remote network, Microsoft says that the chm File runs in a secure region, and the local computer does not do any other work. However, this part is correct. In the content exchange mechanism of a table, the local object points to a URL marked with the JavaScript parameter. When the user clicks, the JavaScript URL is in the next local HTML file. It is executed with help to display an error page (res: // ieframe. dll/navcancl.htm), which means that the script code is in the security zone of the local computer, so any code can be executed