There is an issue in VBScript in the VbsErase function. In some cases, VbsErase fails to clear the argument variable properly, which can trivially lead to crafting a variable with the array type, but with a pointer controlled controlled by an attacker.
e3cbf1077875f9a05eea70f53538809230cbe1a14641ae99c456cce2835e9409