Apache log4net EUVD-2026-93869

Requires a specific deployment: an application running on Windows that uses log4net's EventLogAppender (versions 1.2.9 up to but not including 3.5.0) and that writes attacker-influenceable content into event-log messages. The attacker must be able to make a single logged message large enough that 'message + logName + applicationName + machineName' exceeds the true Windows Event Log record ceiling (~31,736 characters measured on Windows 11 build 26200), at which point the service stores and reports nothing. Limiting factors: non-default/less-common appender choice (EventLogAppender specifically), Windows-only, a long default applicationName (app-domain/assembly name) reduces the attacker's required payload while a short one increases it, and the attacker needs enough control over logged content to reach tens of kilobytes in one record.

Signals point to a genuine but low-priority, niche-configuration issue rather than an urgent one. The CVSS 3.1 base score is 5.3 (Medium) with AV:N/AC:L/PR:N/UI:N, which superficially reads as 'easy remote unauthenticated' - but the impact metrics are C:N/I:L/A:N, meaning the only consequence is partial loss of log integrity (silent suppression of Windows Event Log records), not code execution, data disclosure, or denial of service. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. There is no CISA KEV listing and no public proof-of-concept referenced, and no SSVC decision data was supplied; by the precision rules this is 'no public exploit identified at time of analysis.' Note a conflict in the metadata: the input carries an 'Information Disclosure' tag, yet CWE-778 (Insufficient Logging) and the C:N vector make this an integrity/anti-forensics problem (an attacker suppresses audit records), not a confidentiality one - treat the tag as inaccurate. The AV:N/PR:N framing is defensible because the 'attacker' only needs their data to reach a logged message, but the practical precondition (pushing a single rendered message plus the log/source/machine names past the ~31,736-character Windows ceiling on an app specifically using EventLogAppender) sharply narrows real-world exploitability. Net: a legitimate detection-evasion/logging-reliability defect worth patching on affected Windows deployments, but not a drop-everything emergency.

A Windows application using log4net's EventLogAppender logs attacker-influenced data (e.g., a username, HTTP header, or request field). The attacker submits input long enough that the rendered message combined with the log name, source/application name, and machine name exceeds the real Windows Event Log budget, causing the Event Log service to silently discard the entire record - suppressing evidence of the attacker's own activity. No public exploit is identified at time of analysis; exploitation is low-complexity (AC:L) and requires no authentication per the vector.