EIP-2026-114689

This is a functional local privilege escalation exploit for QNX 6.5.0 targeting a buffer overflow in the setuid-root binary /usr/photon/bin/phfont via the PHOTON_PATH environment variable. It uses a return-to-libc technique to execute system() with a crafted payload, ultimately spawning a root shell.