Oracle Solaris version 11.4 contains a vulnerability in its X Window System component that enables a low‑privileged local user, provided they can obtain a logon to the infrastructure, to carry out unauthorized update, insert, or delete operations on Oracle Solaris data. The flaw also permits the attacker to read portions of data that should be protected and to cause a partial denial of service. The vulnerability does not grant full control over the system and requires the cooperation of a human user other than the attacker. The weakness is a consequence of improper access control within the X Window System, making it a classic example of unauthorized access to sensitive resources.

Oracle Solaris 11.4 on systems that include the X Window System component. No other versions or products are explicitly mentioned as affected.

The CVSS v3.1 base score is 4.2, indicating a low severity. The EPSS score is less than 1%, suggesting a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local, requiring low privilege (PR:L) and high attack complexity (AC:H). A user interaction step (UI:R) is necessary, which further reduces the likelihood of automated exploitation. Overall, the risk is moderate to low for a well‑protected environment, but any local attacker with user credentials still faces a potential data breach or service disruption.