CVE-2026-34480 describes a vulnerability in Apache Log4j Core's XmlLayout up to version 2.25.3 where characters forbidden by the XML 1.0 specification are not properly sanitized. This leads to invalid XML output when such characters appear in log messages or MDC values. The impact varies by StAX implementation: the built-in JRE StAX silently writes forbidden characters producing malformed XML that conforming parsers reject, potentially causing downstream log processing failures; alternative StAX implementations like Woodstox throw exceptions during logging, preventing log events from reaching their intended appenders. Apache Log4j Core 2.25.4 addresses this by sanitizing forbidden characters before XML output.

Malformed XML output can cause conforming XML parsers to reject log files with fatal errors, potentially disrupting downstream log processing systems. Alternatively, some StAX implementations throw exceptions that prevent log events from being delivered to their intended appenders, which may result in loss of log data. There is no indication of direct code execution or privilege escalation. The CVSS score of 6.9 (medium severity) reflects the potential for denial of service or loss of logging data integrity.

Users should upgrade Apache Log4j Core to version 2.25.4 or later, where the issue is fixed by sanitizing forbidden XML characters before output. No other mitigations are indicated. Patch status is not explicitly stated in the vendor advisory excerpt, but the upgrade recommendation confirms an official fix is available.