Oracle Solaris CVE-2025-53068

Exploitation requires an existing authenticated local account with at least low privileges on the Solaris 11 host (AV:L, PR:L) - this is not remotely reachable and cannot be triggered by an unauthenticated network attacker. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local access is obtained the trigger is reliably repeatable. Oracle does not name the specific kernel feature, subsystem, or configuration required, so the only firmly documented prerequisite is local logon access to a Solaris 11 system; the scope change (S:C) means a successful crash may also affect other products co-located with or dependent on that Solaris instance. The need for pre-existing local authentication is the primary limiting factor reducing real-world risk.

This is a moderate-severity local denial-of-service issue, and the multiple signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, base 6.5) describes a low-complexity attack requiring local logon and low privileges, with no confidentiality or integrity impact but complete availability loss and a scope change. The scope change (S:C) is the one factor that elevates this above a routine local DoS, since Oracle states attacks 'may significantly impact additional products' beyond Solaris itself. Exploitation likelihood signals point toward low real-world risk: EPSS is 0.15% (3rd percentile), the CVE is not in CISA KEV, and no public exploit code was identified. There is therefore no evidence of active exploitation or imminent weaponization. The requirement for an authenticated local foothold (PR:L, AV:L) further constrains realistic attackers to those who already have access. Net assessment: a legitimate availability concern worth patching in the Oracle October 2025 CPU cycle, but not an emergency - this is a 'patch in normal cadence' item, not a high-CVSS-but-overhyped issue nor a drop-everything priority.

An attacker who already holds a low-privileged local account on a Solaris 11 host invokes a crafted operation that triggers uncontrolled kernel resource consumption (CWE-400), exhausting a kernel resource and hanging or repeatedly crashing the system. Because the flaw carries a scope change, the resulting outage may also disrupt other products or workloads that depend on that Solaris instance. No public proof-of-concept exploit was identified, so an attacker would need to develop the trigger independently.