PT-2026-27436
CVE-2026-32647
·
Published
2026-03-24
·
Updated
2026-10-07
Description by
CVSS 4.0
8.5
HighMetricsAV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
NGINX Open Source and NGINX Plus versions (affected versions not specified)
Description
NGINX Open Source and NGINX Plus, when built with the
ngx http mp4 module module and configured with the mp4 directive, are susceptible to a buffer over-read or over-write in the NGINX worker memory. This can occur when processing a specially crafted MP4 file, potentially leading to service termination or code execution. The issue is exploitable only if an attacker can trigger the processing of the malicious MP4 file using the ngx http mp4 module module.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾