Executive brief
Membrane MP4 Plugin is a library for parsing MP4 video files used in Erlang/Elixir media processing applications. An attacker can craft a malicious MP4 file with a large number of unique box names that causes the library to crash the entire BEAM runtime (the virtual machine running Erlang/Elixir), taking down all applications running on that instance. No user authentication or special network access is required—simply processing the file is enough to trigger the crash.
Technical details
The vulnerability is a resource-exhaustion denial-of-service (CWE-770) in the MP4 container parser. The vulnerable code in `Membrane.MP4.Container.Header.parse/1` uses `String.to_atom/1` to intern every 4-byte MP4 box name into the global BEAM atom table without validation. Unlike regular objects, BEAM atoms are never garbage-collected and are bounded by a fixed ceiling (~1,048,576 atoms per runtime). An attacker can generate an ~8 MB MP4 file with roughly 1.1 million minimal box headers, each containing a unique 4-byte ASCII name. Processing this file via `Membrane.MP4.Container.parse/1` or its bang variant will exhaust the atom table and force the entire BEAM node to abort. The fix (version 0.36.7+) replaces unsafe interning with `String.to_existing_atom/1` and treats unknown box names as the `:unknown` atom, preventing unbounded atom creation. Attack vector is local or network (depending on deployment), requires no privileges or user interaction, and impacts only availability.
Affected products
- Membrane Framework membrane_mp4_plugin < 0.36.7
Timeline
- 2026-06-11: disclosed: CVE-2026-53423 published by NVD
- 2026-08-18: advisory: GitHub Security Advisory GHSA-43hj-fxwj-49qw published
- 2026-06-11: patched: Fix released in version 0.36.7