Elevated privilieges are not dropped than external aplication is executed or log file is open.
vulners.com/securityvulns/securityvulns:doc:8666
vulners.com/securityvulns/securityvulns:doc:9066