EIP-2026-104561

This exploit leverages a PATH environment variable manipulation to escalate privileges to root on macOS X <= 10.2.4. It requires DirectoryService to be crashed prior to execution and manipulates the PATH to execute a malicious 'touch' binary with elevated privileges.