An improperly handled Unicode encoding issue in the SmtpPickupDirAppender of Apache log4net causes the mail file writer to throw when it encounters content that cannot be encoded, such as unpaired UTF-16 surrogates. When this exception occurs, the appender discards the entire buffered batch of log events, leaving only a truncated mail file in the pickup directory. Consequently, an attacker who can inject such Unicode content into a log message can suppress or erase other log records, undermining monitoring and audit trails.

Apache log4net versions from 1.2.9 up to but excluding 3.5.0 are affected. The flaw resides in the SmtpPickupDirAppender, so only applications that configure this appender are susceptible. The product is maintained by the Apache Software Foundation.

The vulnerability receives a CVSS score of 5.3, indicating moderate impact. The EPSS value is not released, and it is not listed in CISA KEV. The attack vector is likely local or through the application’s logging interface, because the malicious payload must reach the log message that the appender processes. An attacker who can influence application input could craft a Unicode string that triggers the exception, causing loss of log data but not leading to code execution or denial of service. The exploit is constrained to systems that use the vulnerable appender; there is no remote exploit path identified.