Apache log4net EUVD-2026-93866

Exploitation requires the target application to be configured to use SmtpPickupDirAppender (the SMTP pickup-directory mail appender) with event buffering, and the attacker must be able to get content they control - specifically a string the UTF-8/UTF-16 writer cannot encode, such as an unpaired surrogate like U+D800 - into a message that log4net renders. The limiting factors are significant: applications not using SmtpPickupDirAppender are entirely unaffected, the payload must survive the application's own input handling intact to reach the log layout, and the practical impact is confined to suppressing/truncating buffered log output rather than any confidentiality or service-availability loss. No end-user interaction or log4net authentication is needed once attacker data reaches a logged field.

This is a genuinely low-to-moderate priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) reflects an integrity-only impact with no confidentiality or availability loss - the attacker cannot read data or crash the service, only suppress or truncate log records. No EPSS score was provided in the input, there is no CISA KEV listing, and the only references are the fixing commit, pull request #315, and an Apache mailing-list thread - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The PR:N rating is technically correct (any party whose data reaches a logged message can trigger it without authenticating to log4net itself), but this is tempered by a hard structural precondition: the issue only manifests in applications that both use SmtpPickupDirAppender AND buffer multiple events, a rarely-used configuration. The practical impact is anti-forensic log suppression - an attacker who gets an unpaired UTF-16 surrogate into one log message can destroy an entire batch of buffered events and leave a truncated mail - which matters for audit integrity but is not a classic code-execution or data-breach threat. No SSVC decision data was provided in the input. Net: real but niche; prioritize only if SmtpPickupDirAppender is in use and log integrity is security-relevant.

An attacker submits input (e.g. a username, header, or form field) containing an unpaired UTF-16 surrogate (such as U+D800) that an application logs via log4net. When SmtpPickupDirAppender flushes its buffered batch, File.CreateText throws on the unencodable character, discarding every other buffered event in that batch and leaving a truncated mail file in the pickup directory. No public exploit code was identified in the provided references; exploitation is network-reachable and low-complexity but requires the target to use the vulnerable appender.