Root command execution via writable spool directory

Improper privilege management in Exim before 4.94.2 allows local users with the Exim account to execute commands as root. Exim performs privileged operations inside an Exim-owned spool directory, letting that account alter input headers, overflow dbfn_open with long names, or redirect chown through links. Access as the Exim service account is required; successful exploitation grants full root privileges on the host.