This vulnerability arises from an improper neutralization of a NUL (null) byte in Apache log4net’s OutputDebugStringAppender. When a log message contains a NUL character, the appender treats it as the end of the record, discarding any data that follows, including exception details and trailing fields. The result is that logs are truncated or silently corrupted, which can hide malicious or sensitive content and interfere with monitoring and troubleshooting. The weakness is a classic CWE‑158 scenario involving improper handling of a null byte.

The flaw affects the log4net library version 1.2.9 through the pre‑3.5.0 releases. It is limited to Windows applications that use the OutputDebugStringAppender; other operating systems or alternative appenders are unaffected. The product, managed by the Apache Software Foundation, is commonly used by .NET developers for application logging.

The CVSS score is 5.3, indicating a moderate severity. No EPSS data is available, and the issue has not been listed in the CISA KEV catalog, suggesting limited known exploitation. Attacks would require the ability to inject log content that contains a NUL byte, which may be possible through user input if the application passes untrusted data directly to the logger. The risk is therefore moderate and primarily concerns data integrity and the possibility of concealing sensitive information in logs.