Apache Log4j Core's XmlLayout does not sanitize characters forbidden by the XML 1.0 specification. When log messages or MDC values contain these characters, the layout writes them unchanged or throws an exception, producing malformed XML. Conforming XML parsers then reject the document or downstream systems drop the affected log records, resulting in partial or total loss of log events and loss of audit trail evidence.

The vulnerability affects Apache Log4j Core versions up to and including 2.25.3, regardless of the underlying StAX implementation. The built‑in JRE StAX results in silent corruption, while alternative StAX libraries such as Woodstox cause an exception that prevents the event from reaching its intended appender.

The CVSS score is 6.9, indicating a moderate impact. EPSS is below 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of exploitation. Attackers would need to supply log inputs containing forbiddable XML characters; the effect is loss of logging integrity rather than remote code execution. The risk is primarily to incident response and compliance audits where log completeness is essential.