If the HOME environment variable is unset or empty, top will read its configuration file from the current working directory without any security check.  If a user runs top with HOME unset in an attacker-controlled directory, the attacker could acieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.