Microsoft compiled HTML Help and uncompiled .chm files can be leveraged for XML external entity injection attacks.