Junglewise Threat Intelligence

CVE-2026-27784: NGINX Open Source memory corruption in ngx_http_mp4_module

CVE-2026-27784 · Severity: high · CVSS 7.8 · Published 2026-03-24

Technologies: Red Hat Enterprise Linux, NGINX Open Source. Vendors: Red Hat, NGINX.

Executive brief

A vulnerability exists in the 32-bit version of NGINX, a widely used web server and proxy, specifically within its MP4 video processing module. By providing a specially crafted MP4 file, an attacker can cause the server to crash or potentially access sensitive information in the server's memory. This could lead to service outages or the exposure of data handled by the web server.

Technical details

An integer overflow vulnerability (CWE-190) exists in the ngx_http_mp4_module of 32-bit NGINX Open Source. The flaw is triggered when the 'mp4' directive is enabled in the configuration and the server processes a specially crafted MP4 file. This can result in an out-of-bounds read or write in NGINX worker memory, leading to a denial of service (worker termination) or potentially arbitrary code execution. While some CVSS vectors suggest a local attack vector (AV:L), the nature of NGINX as a web server means this can often be triggered via network requests if the server is configured to serve or process user-provided MP4 content. Red Hat has released several security advisories (e.g., RHSA-2026:13634) to address this issue across its product line.

Affected products

  • NGINX NGINX Open Source (32-bit) All 32-bit versions with ngx_http_mp4_module enabled
  • Red Hat Red Hat Enterprise Linux 8, 9, 10.0 EUS, 10.1
  • Red Hat Red Hat Update Infrastructure 5.1

Timeline

  • 2026-03-24: disclosed: Initial publication date
  • 2026-04-23: patched: Red Hat released updates for Red Hat Update Infrastructure
  • 2026-05-05: patched: Red Hat released updates for NGINX on RHEL 10.0 EUS

References

Related threats