The vulnerability is a format string injection in configuration settings of Revive Adserver. When an attacker supplies certain character combinations, the PHP process throws a fatal error, causing the admin console to become unusable. This weakness corresponds to CWE‑134, which can lead to a loss of functionality for privileged users. The consequence is a denial of service to administrators, preventing configuration changes and potentially interrupting ad delivery schedules.

Revive Adserver is affected; no specific version information is available, so any installation that uses the current settings interface should be treated as potentially vulnerable.

The CVSS score of 2.7 indicates moderate severity, but the low EPSS score (<1%) and absence from the KEV catalog suggest a low likelihood of exploitation in the near term. The likely attack vector is through authenticated access to the admin interface, where an attacker can modify settings. The vulnerability requires administrator privileges to inject the format string; unauthenticated users cannot trigger the error. Because the impact is limited to a denial of service for administrators, the overall risk is considered low to moderate.