Apache Log4net’s XmlLayout and XmlLayoutSchemaLog4J fail to escape characters forbidden by the XML 1.0 specification found in MDC property keys and values and in the identity field. When these characters are present, an exception occurs during serialization, causing the entire log event to be silently dropped. This loss of log records directly undermines the reliability of audit logs, which can prevent detection of malicious activity. The weakness is a classic example of improper input sanitization (CWE‑116).

The vulnerability affects Apache Log4net libraries released before version 3.3.0. All deployments of Log4net running those older versions are susceptible, regardless of specific host or operating system, as the issue is confined to the library itself.

The CVSS score of 6.3 indicates a moderate severity, but since the exploitation requires an attacker to inject or influence data that ends up in MDC keys, values, or the identity field, the attack vector is typically through application inputs that are logged. The exact probability of exploitation is unknown because EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker with the ability to control these fields could quietly remove specific log entries, thereby erasing evidence of their activity and weakening defensive monitoring.