The popular open-source MTA (mail transfer agent) Exim has a critical vulnerability which allows an attacker to exploit a heap-based buffer overflow (in string_vformat), potentially leading to arbitrary code execution. Normally Exim will have dropped its root privileges by the point this vulnerability is exploitable, but when combined with local privilege escalation exploits (or other as-yet known code paths within Exim to trigger the buffer overflow), arbitrary code execution with root privileges would be feasible.