The ModSecurity web application firewall includes a flaw in the t:utf8toUnicode transformation; on i386 processors the function incorrectly uses snprintf with sizeof on a character pointer instead of the expected Unicode buffer length, producing malformed Unicode output. This represents a data conversion error (CWE‑131) and also involves uninitialized memory usage (CWE‑467). Rules that rely on this transformation therefore process payloads that would normally be blocked to pass through. No explicit statement indicates code execution or privilege escalation; it is inferred from the mention that only rule bypass is impacted. The potential for injection or cross‑site scripting attacks that exploit the weakened filtering is also inferred.

The vulnerability affects the OWASP ModSecurity project, specifically engine versions 3.0.0 through 3.0.15 inclusive. These releases support Apache, IIS and Nginx WAF deployments on various platforms. The issue is present only on i386 architectures; non‑i386 builds are not impacted. The bug was corrected in ModSecurity 3.0.16.

The CVSS base score of 5.8 classifies this as a medium‑severity vulnerability, and the EPSS score of less than 1% indicates that exploitation is considered unlikely but not impossible. The vulnerability is not listed in CISA KEV. Because the flaw is triggered by normal HTTP traffic and can be leveraged by sending crafted requests to an affected i386 server, the bypass of ModSecurity rules can be achieved with little effort; this is inferred from the vulnerability description. However, the limited scope—the requirement for an i386 environment—reduces the overall attack surface compared to a generic vulnerability that affects all architectures; this reduction is inferred.