CVE-2026-32647 — NGINX ngx_http_mp4_module vulnerability

Description (CNA)

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected (CNA)

Vendor / product	Versions
F5 / NGINX Open Source	affected 1.29.0 before 1.29.7; affected 1.1.19 before 1.28.3
F5 / NGINX Plus	affected R36 before R36 P3; affected R35 before R35 P2; affected R34 before ; affected R33 before ; affected R32 before R32 P5

CWE

CWE-125

References

https://my.f5.com/manage/s/article/K000160366

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in NGINX's ngx_http_mp4_module. This Out-of-Bounds Read/Write vulnerability occurs due to improper handling of specially crafted MP4 files. A local authenticated attacker, by supplying a malicious MP4 file, can trigger a buffer over-read or overwrite in worker memory. This can lead to process termination, potentially causing a denial-of-service or, under certain conditions, achieving code execution.