A flaw exists in the X Window System component of Oracle Solaris 11.4 that can be triggered by a local attacker with low privileges. This vulnerability is classified as CWE‑269, an elevation of privilege flaw. The flaw does not require user interaction or remote connectivity, but requires the attacker to have logon rights on the affected host. Successful exploitation can allow the attacker to update, insert, or delete data that is normally protected by the operating system, to read a subset of protected data, or to cause a partial denial of service that impairs system availability. The CVSS 3.1 score of 4.5 indicates moderate confidentiality, integrity, and availability impacts.

Oracle Solaris 11.4 running the X Window System. No other versions or upstream products are listed as affected. The vulnerability is limited to the Solaris operating system and specifically to the graphical subsystem provided by X Window.

The CVSS Base Score of 4.5 reflects a moderate severity and the absence of a usable remote attack vector lowers the overall risk. EPSS < 1%, indicating a very low probability of exploitation. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Attackers would need local logon and the ability to execute X Window processes; the low privilege requirement reduces the likelihood of exploitation in a typical hardened environment, but the potential to alter or read data warrants timely mitigation.