The flaw is a resource exhaustion condition, identified as CWE‑400, that allows a low privileged attacker who is logged on to an Oracle Solaris host to induce a hang or crash. An attacker must cause the vulnerable component to execute and requires another person’s interaction to trigger the effect. Once activated, the service runs out of usable resources, leading to a complete denial of service for the affected system.

Oracle Solaris versions 10 and 11 are affected. The vulnerability is present in the file system component of these operating systems and therefore applies to any infrastructure running either of these Solaris releases.

The CVSS 3.1 base score of 5.0 indicates a medium severity with an availability impact. The EPSS score being below 1% suggests a very low likelihood of exploitation at the present time, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the attack requires only local low‑privileged credentials and a human interaction step, it can be executed relatively easily on an exposed system. The primary risk is repeated crashes that can disrupt services and degrade system availability, especially in environments where Solaris is run as a critical component of a larger infrastructure.