PT-2026-27431
CVE-2026-27784
·
Published
2026-03-24
·
Updated
2026-10-07
Description by
CVSS 4.0
8.5
HighMetricsAV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
NGINX Open Source (affected versions not specified)
Description
The 32-bit implementation of NGINX Open Source contains an issue within the
ngx http mp4 module module. This can allow an attacker to read from or write to NGINX worker memory, potentially causing the service to terminate. The issue requires a specially crafted MP4 file to be processed by the ngx http mp4 module module. This is only possible if the NGINX Open Source installation is 32-bit, built with the ngx http mp4 module module, and the mp4 directive is used in the configuration file.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾