# CVE-2026-32647: NGINX Open Source and Plus buffer overflow in ngx_http_mp4_module

Source: https://junglewise.ai/threats/cve-2026-32647-nginx-open-source-and-plus-buffer-overflow-in-ngx-http-mp4-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-24. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-32647 · Severity: high · CVSS 7.8 · Published 2026-03-24

NGINX, a widely used web and proxy server, contains a vulnerability in its MP4 video processing module. An attacker who can provide a malicious video file to the server could cause the software to crash or potentially execute unauthorized code. This could lead to a disruption of web services or unauthorized access to the server's memory and data.

Technologies: [NGINX Open Source](https://junglewise.ai/threats/technologies/open-source). Vendors: [NGINX](https://junglewise.ai/threats/vendors/nginx).

## Quick answers

**Is CVE-2026-32647 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32647 being exploited in the wild.

**How severe is CVE-2026-32647?** High severity, with a CVSS score of 7.8, published 24 March 2026.

**Which products and versions are affected?** NGINX Open Source All versions built with ngx_http_mp4_module and mp4 directive enabled.

**Is there a fix for CVE-2026-32647?** A patch was published on 2026-04-23: Red Hat released initial security updates (RHSA-2026:10065) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32647 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-32647?** Check whether you run NGINX Open Source at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the ngx_http_mp4_module of NGINX Open Source and NGINX Plus. The flaw is triggered when the module processes a specially crafted MP4 file, leading to a buffer over-read or over-write in the NGINX worker memory. This issue requires the NGINX instance to be built with the ngx_http_mp4_module and have the 'mp4' directive active in the configuration. An attacker with the ability to trigger the processing of such a file (typically requiring local or low-privileged access to upload or point the server to the file) can cause a denial of service via process crash or potentially achieve arbitrary code execution. Red Hat has released security advisories (e.g., RHSA-2026:13634) providing patches for affected Enterprise Linux versions.

## Affected products

- NGINX NGINX Open Source All versions built with ngx_http_mp4_module and mp4 directive enabled
- NGINX NGINX Plus All versions built with ngx_http_mp4_module and mp4 directive enabled
- Red Hat Red Hat Enterprise Linux 8, 9, 10.0, 10.1

## Timeline

- 2026-03-24: disclosed: Initial publication date
- 2026-04-23: patched: Red Hat released initial security updates (RHSA-2026:10065)

## References

- [https://my.f5.com/manage/s/article/K000160366](https://my.f5.com/manage/s/article/K000160366)
- [https://access.redhat.com/errata/RHSA-2026:10065](https://access.redhat.com/errata/RHSA-2026:10065)
- [https://access.redhat.com/errata/RHSA-2026:13634](https://access.redhat.com/errata/RHSA-2026:13634)
- [https://access.redhat.com/errata/RHSA-2026:13680](https://access.redhat.com/errata/RHSA-2026:13680)
- [https://access.redhat.com/errata/RHSA-2026:13839](https://access.redhat.com/errata/RHSA-2026:13839)
- [https://access.redhat.com/errata/RHSA-2026:14836](https://access.redhat.com/errata/RHSA-2026:14836)
- [https://access.redhat.com/errata/RHSA-2026:15942](https://access.redhat.com/errata/RHSA-2026:15942)

## Related threats

- [NGINX Plus and Open Source heap buffer overflow in alias directive with rewrite](https://junglewise.ai/threats/cve-2026-15176-a-vulnerability-exists-in-nginx-plus-and-nginx-open-source-when-a)
- [NGINX Plus and Open Source HTTP/3 heap buffer overflow in TLS handshake](https://junglewise.ai/threats/cve-2026-90439-nginx-plus-and-open-source-http-3-heap-buffer-overflow-in-tls)
- [F5 NGINX heap buffer over-read in ngx_http_charset_module](https://junglewise.ai/threats/cve-2026-42934-f5-nginx-heap-buffer-over-read-in-ngx-http-charset-module)
- [F5 NGINX Open Source header injection in HTTP/2 proxying](https://junglewise.ai/threats/cve-2026-42926-f5-nginx-open-source-header-injection-in-http-2-proxying)
- [F5 NGINX heap-use-after-free in ngx_http_ssl_module](https://junglewise.ai/threats/cve-2026-40701-f5-nginx-heap-use-after-free-in-ngx-http-ssl-module)