The Log4j1XmlLayout component fails to escape characters forbidden by XML 1.0, producing malformed XML logs. Conforming parsers reject such documents with a fatal error, causing downstream log processing to drop or fail to index these events. The defect does not provide arbitrary code execution but leads to loss of audit data, reducing the integrity of logs.

Deployments using the Apache Log4j 1-to-Log4j 2 bridge are vulnerable. This includes configurations that employ Log4j1XmlLayout directly in Log4j Core 2, and those that use the Log4j 1 compatibility layer with org.apache.log4j.xml.XMLLayout. The vulnerability applies to any version prior to the corrected 2.25.4 release; no specific older version range is listed.

The CVSS score of 6.9 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The CVE is not in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need the ability to inject log entries containing XML‑forbidden characters, typically by influencing application input that is logged. No remote code execution or elevated privilege is required, so the risk of exploitation remains relatively low, but the loss of logs can impair incident response and compliance.