The flaw causes a NUL character inserted into log data to terminate a Windows Event Log entry, so any log content rendered after it—including exception details and additional fields—is silently discarded. Attackers can use this to conceal sensitive information, effectively tampering with system logs and reducing their usefulness for troubleshooting or forensic analysis.

This vulnerability affects Apache log4net 1.2.9 up to, but not including, version 3.5.0 on Windows platforms where the EventLogAppender is configured.

The CVSS score of 5.3 indicates low‑to‑moderate severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, suggesting a modest likelihood of exploitation in the wild. The attack vector requires the adversary to supply or influence log content that reaches the EventLogAppender, which could be achieved with local code execution or by compromising the application to inject NUL characters. The consequence is superior log integrity loss, which can impede incident response and auditing.