Vulnerability in the Oracle Solaris X Window System allows a low‑privileged user with logon rights to modify, insert, delete, or read data that should be protected. The flaw is an example of improper access control (CWE‑200) that enables attackers to bypass expected security boundaries for the Solaris system. Successful exploitation can lead to unauthorized data tampering, unauthorized data reads, and the ability to disrupt some system services, producing a partial denial of service.

The affected product is Oracle Solaris 11.4 running the X Window System component. No other versions or products are listed as impacted.

The CVSS 3.1 base score of 5.3 reflects moderate impacts on confidentiality, integrity, and availability. The EPSS score is less than 1%, indicating a very low but nonzero probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exfil requires a local login; no network access or additional user interaction beyond the initial logon is needed. Once the flaw is leveraged, an attacker can read and modify protected data and cause a partial denial of service.