EIP-2026-114736

This exploit leverages a design error in Solaris xscreensaver's -log command-line switch to create arbitrary files, enabling privilege escalation via LD_PRELOAD. It compiles a shared library to override getuid() and places it in a trusted directory, then triggers the vulnerability to escalate to root.