This vulnerability is an out‑of‑bounds write in the finish_partial_char function of the mod_charset_lite module. The flaw allows a malformed HTTP request to corrupt the heap memory that the module uses to convert character sets. If an attacker succeeds, they could replace or corrupt memory, leading to potential arbitrary code execution or a crash that disrupts service.

The flaw exists in Apache HTTP Server 2.4.0 through 2.4.68, released by the Apache Software Foundation. Any installation of Apache HTTP Server in that version range that has mod_charset_lite enabled— which is default in most builds— is vulnerable.

The CVSS score is 7.5, indicating high risk. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, since the mod_charset_lite module parses data from HTTP requests. An attacker can trigger the exploit by sending a specially crafted request that causes an out‑of‑bounds write, potentially leading to arbitrary code execution. No specific authentication or privilege escalation requirements are listed, implying that a publicly reachable server could be targeted.