EIP-2026-114760

This exploit leverages a vulnerability in the 'mail' console e-mail client by crafting a malicious Reply-To field with hidden shell metacharacters and backspace characters to deceive the recipient. Upon reply, arbitrary commands from a pre-placed file in /tmp are executed, potentially leading to privilege escalation.