Root-owned file clobbering via PID path override

Improper privilege management in Exim before 4.94.2 allows local users with the exim account to overwrite root-owned files. The override_pid_file_path option accepts an attacker-chosen -oP path, and the setuid-root daemon creates or truncates that file while writing an uncontrollable PID. Access to the exim service account is required; direct exploitation can corrupt privileged files and interrupt service, while full root compromise requires chaining another flaw.