EIP-2026-103088

This exploit targets a buffer overflow vulnerability in Citadel/UX's 'USER' command handling. It uses a ret-to-libc technique to bypass the tolower() function and execute arbitrary commands, specifically adding a root user to /etc/passwd.