CVE-2016-6253

CVE-2016-6253 describes a local privilege escalation vulnerability in the mail.local utility across NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0. This flaw allows a local attacker to perform a symlink attack on a user's mailbox, enabling them to change ownership of or append data to arbitrary files on the system. With a CVSS v3 score of 7.8 (High), the vulnerability poses a significant risk due to its low attack complexity and high impact on confidentiality, integrity, and availability. Exploit code, including a Metasploit module and entries in ExploitDB, is publicly available, though there is no indication of active exploitation in the wild or significant community discussion.