Is CVE-2026-27784 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27784 being exploited in the wild.

How severe is CVE-2026-27784?

High severity, with a CVSS score of 7.8, published 24 March 2026.

Which products and versions are affected?

NGINX Open Source All 32-bit versions with ngx_http_mp4_module enabled.

Is there a fix for CVE-2026-27784?

A patch was published on 2026-04-23: Red Hat released updates for Red Hat Update Infrastructure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27784 attacked?

It is attacked over the network or with local access, in a web application.

Am I affected by CVE-2026-27784?

Check whether you run NGINX Open Source at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27784: NGINX Open Source memory corruption in ngx_http_mp4_module

CVE-2026-27784 · Severity: high · CVSS 7.8 · Published 2026-03-24

A vulnerability exists in the 32-bit version of NGINX, a widely used web server and proxy, specifically within its MP4 video processing module. By providing a specially crafted MP4 file, an attacker can cause the server to crash or potentially access sensitive information in the server's memory. This could lead to service outages or the exposure of data handled by the web server.

Technologies: NGINX Open Source. Vendors: NGINX.

Quick answers

Is CVE-2026-27784 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27784 being exploited in the wild.
How severe is CVE-2026-27784?: High severity, with a CVSS score of 7.8, published 24 March 2026.
Which products and versions are affected?: NGINX Open Source All 32-bit versions with ngx_http_mp4_module enabled.
Is there a fix for CVE-2026-27784?: A patch was published on 2026-04-23: Red Hat released updates for Red Hat Update Infrastructure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27784 attacked?: It is attacked over the network or with local access, in a web application.
Am I affected by CVE-2026-27784?: Check whether you run NGINX Open Source at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability (CWE-190) exists in the ngx_http_mp4_module of 32-bit NGINX Open Source. The flaw is triggered when the 'mp4' directive is enabled in the configuration and the server processes a specially crafted MP4 file. This can result in an out-of-bounds read or write in NGINX worker memory, leading to a denial of service (worker termination) or potentially arbitrary code execution. While some CVSS vectors suggest a local attack vector (AV:L), the nature of NGINX as a web server means this can often be triggered via network requests if the server is configured to serve or process user-provided MP4 content. Red Hat has released several security advisories (e.g., RHSA-2026:13634) to address this issue across its product line.

Affected products

NGINX NGINX Open Source (32-bit) All 32-bit versions with ngx_http_mp4_module enabled
Red Hat Red Hat Enterprise Linux 8, 9, 10.0 EUS, 10.1
Red Hat Red Hat Update Infrastructure 5.1

Timeline

2026-03-24: disclosed: Initial publication date
2026-04-23: patched: Red Hat released updates for Red Hat Update Infrastructure
2026-05-05: patched: Red Hat released updates for NGINX on RHEL 10.0 EUS

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.