Local root command execution via spool header injection

Local privilege escalation in Exim before 4.94.2 allows local users to execute arbitrary commands as root through a crafted recipient address. Exim writes an unescaped newline-bearing recipient into the spool header, where spool_read_header accepts an injected negative length that moves the allocator backward and lets a fake header overwrite configuration strings. Any unprivileged local account can invoke the set-user-ID Exim binary; with deliver_drop_privilege disabled by default, later delivery expands the overwritten command string as root.