The flaw exists in the Libraries component of Oracle Solaris 11.4. An attacker who has local logon privileges can manipulate the program's behavior to read data files that are normally protected by the operating system's access control mechanisms. The breach does not grant code execution or full system takeover but allows unauthorized disclosure of sensitive information.

Only Oracle Solaris version 11.4 is affected, as indicated by the Oracle security advisory and the CPE string. No other releases or builds are listed as vulnerable in the current data set.

The CVSS 3.1 base score of 3.3 classifies the vulnerability as low severity, with a small confidentiality impact and no denial‑of‑service or integrity effects. EPSS is not available, and the vulnerability is not currently listed in CISA's KEV catalog, indicating limited evidence of exploitation in the wild. Attackers would need a local account, making the threat surface limited but still relevant for environments that grant broad user privileges.