A heap-based buffer overflow occurs when Apache HTTP Server processes untrusted XML content through mod_xml2enc, specifically during the xml2StartParse function. The vulnerability could allow an attacker to manipulate allocated memory on the heap, potentially leading to application crashes or the execution of arbitrary code. The unsafe handling of untrusted XML data enables the attacker to trigger the overflow during normal HTTP request processing, making the flaw exploitable remotely.

The flaw affects Apache HTTP Server versions 2.4.0 through 2.4.67 released by the Apache Software Foundation. Users running any of these builds are at risk until they upgrade to a version that contains the fix.

The vulnerability is a classic heap buffer overflow (CWE-120 and CWE-122). The EPSS score is less than 1%, indicating a very low but nonzero exploitation probability. The flaw is not listed in CISA KEV. The CVSS base score is 7.5, indicating a high severity and potential for remote exploitation. The attack vector is inferred to be remote, via crafted XML sent over HTTP to the vulnerable server. An attacker could likely cause a crash or hijack execution if the exploit succeeds.