EPS image filter — CVE-2017-0261/0262

CVE-2017-0261 and CVE-2017-0262 exploit the Windows EPS (Encapsulated PostScript) image filter (EPSIMP32.FLT) used by Microsoft Office. A crafted EPS image inside an Office document triggers a use-after-free or out-of-bounds read that allows arbitrary code execution. These vulnerabilities were exploited in highly targeted APT campaigns in 2017. The rule matches EPSIMP32 or %!PS-Adobe markers; it does not validate the malformed EPS needed to identify a specific EPS CVE.