A heap-based buffer overflow occurs when Apache HTTP Server processes untrusted XML content through mod_xml2enc, specifically during the xml2StartParse function. The vulnerability could allow an attacker to manipulate allocated memory on the heap, potentially leading to application crashes or the execution of arbitrary code. The unsafe handling of untrusted XML data enables the attacker to trigger the overflow during normal HTTP request processing, making the flaw exploitable remotely.

The flaw affects Apache HTTP Server versions 2.4.0 through 2.4.67 released by the Apache Software Foundation. Users running any of these builds are at risk until they upgrade to a version that contains the fix.

The vulnerability is a classic heap buffer overflow (CWE-122). No EPSS score is available, and the flaw is not listed in CISA KEV. While the exact CVSS base score is not provided, the nature of the flaw suggests a high potential for remote exploitation. The attack vector is inferred to be remote, via crafted XML sent over HTTP to the vulnerable server. An attacker could likely cause a crash or hijack execution if the exploit succeeds.