EIP-2026-100007

This exploit leverages a race condition in the bellmail command on AIX 5.1 to change the ownership of any file to the current user. The script repeatedly creates and removes a symlink to the target file while bellmail is running, exploiting the race condition to gain ownership.