The NeXT NetInfo writers property allows local users to gain root privileges or conduct a denial of service.

pcnfsd (aka rpc.pcnfsd) allows local users to change file permissions, or execute arbitrary commands through arguments in the RPC call.

Buffer overflow of rlogin program using TERM environmental variable.

Buffer overflow in lpr, as used in BSD-based systems including Linux, allows local users to execute arbitrary code as root via a long -C (classification) command line option.