The flaw stems from a missing sanitization call in the afsql_dd_run_query routine, allowing an attacker to inject arbitrary SQL when the syslog-ng SQL destination driver processes untrusted log data. This gives the attacker the ability to read, modify or delete records in the configured database, thereby compromising confidentiality and integrity of stored information. The vulnerability is a classic instance of CWE‑150 (Unit of Work Injection).

Syslog-ng versions before 4.12, as well as the Premium Edition up to 8.2 and the Store Box up to 7.8, are vulnerable when the SQL destination driver is enabled. The driver is not activated by default; an attacker must have influence over a configuration that includes the driver to trigger the injection.

With a CVSS score of 7.1, the vulnerability is rated high. The EPSS of less than 1 % indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the driver processes untrusted log content, an attacker could send crafted log messages that are executed against the database, making the risk real when the driver is active and exposed to untrusted sources.