Nginx Open Source CVE-2026-32647

|

EUVD

EUVD-2026-14897 HIGH

Out-of-bounds Read (CWE-125)

2026-03-24 f5

RCE Buffer Overflow Information Disclosure Nginx Nginx Open Source Nginx Plus F5

8.5

CVSS 4.0 · Vendor: f5

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Upload specially crafted MP4 file
Exploit

NGINX mp4_module parses malformed atoms
Execution

Buffer over-read/over-write in worker memory
Impact

Worker process crash or arbitrary code execution

Vulnerability Assessment

Weakness	CWE CWE-125 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	NGINX Open Source or NGINX Plus must be compiled with ngx_http_mp4_module enabled and mp4 directive configured. Attacker requires local access to upload or place a crafted MP4 file that NGINX processes through this module.
Impact	The CVSS score of 7.8 initially suggests high severity, but the attack vector requires local access (AV:L) and the ability to trigger processing of a malicious MP4 file, significantly constraining real-world exploitation scenarios. The attacker needs low-level privileges (PR:L) and low attack complexity (AC:L), but cannot exploit this remotely without first gaining local system access or convincing an administrator to process a malicious file. No EPSS score or KEV status is mentioned in the provided data, suggesting this is not currently known to be actively exploited in the wild. The primary risk applies to shared hosting environments, systems where users can upload MP4 files for server-side processing, or scenarios where an attacker has already established local access. For most internet-facing NGINX deployments without MP4 processing functionality, the practical risk is lower than the CVSS score suggests, though the potential for code execution warrants attention in affected configurations.
Exploit ScenarioDerived	An attacker who has gained low-level local access to a server running NGINX with MP4 streaming enabled uploads or places a specially crafted MP4 file in a location where NGINX will process it. When NGINX attempts to parse the malicious MP4 file through the ngx_http_mp4_module, the crafted file triggers a buffer over-read or over-write condition, potentially allowing the attacker to crash the NGINX worker process or achieve code execution within the context of the NGINX worker, enabling further system compromise.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Mar 24, 2026

NGINX Open Source and NGINX Plus contain a buffer over-read or over-write vulnerability in the ngx_http_mp4_module that can lead to NGINX worker process termination or potentially remote code execution. An attacker with local access and the ability to supply a specially crafted MP4 file for processing can exploit this flaw when the mp4 directive is enabled in the configuration. The vulnerability has a CVSS score of 7.8 with high impact on confidentiality, integrity, and availability, though exploitation requires local access (AV:L) and low-level privileges (PR:L).

RemediationAI

Consult the F5 security advisory at https://my.f5.com/manage/s/article/K000160366 for specific patch versions and upgrade instructions for both NGINX Open Source and NGINX Plus. As an immediate mitigation, if MP4 streaming functionality is not required, disable the ngx_http_mp4_module by removing or commenting out mp4 directives from the NGINX configuration file and recompiling NGINX without the module if possible. For environments that require MP4 processing, implement strict input validation and file upload controls, restrict which users or processes can trigger MP4 file processing, and isolate NGINX workers using operating system-level sandboxing or containerization to limit the impact of potential code execution. Apply the principle of least privilege to the NGINX worker processes to minimize the attack surface until patching is complete.

Affected VersionsENISA

NGINX Plus R35 <R35 P2

NGINX Plus R32 <R32 P5

NGINX Plus R36 <R36 P3

NGINX Plus R33 <*

NGINX Open Source 1.1.19 <1.28.3

NGINX Open Source 1.29.0 <1.29.7

NGINX Plus R34 <*

Affected Packages

euvd nginx_open_source fix: 1.28.3, 1.29.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

The ngx_http_mp4_module is an NGINX module that provides pseudo-streaming support for MP4 files, enabling byte-range requests and seeking within video files. According to the CPE data, both NGINX Open Source (cpe:2.3:a:f5:nginx_open_source) and NGINX Plus (cpe:2.3:a:f5:nginx_plus) maintained by F5 are affected. The root cause is classified as CWE-125 (Out-of-bounds Read), though the description indicates both over-read and over-write conditions are possible, suggesting potential memory corruption vulnerabilities in the MP4 file parsing logic. The module must be explicitly compiled into NGINX and the mp4 directive must be present in the configuration file for the system to be vulnerable, limiting the attack surface to deployments specifically using MP4 streaming functionality.

Know when Nginx Open Source gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (f5) PRIMARY 8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat 7.8 HIGH

Primary rating from Vendor (f5).

CVSS VectorVendor: f5

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

3

Analysis Updated

Apr 16, 2026 - 06:18 EUVD-patch-fix

executive summary

Patch available

Apr 16, 2026 - 05:29 EUVD

1.28.3,1.29.7

CVE Published

Mar 24, 2026 - 14:13 nvd

HIGH 8.5

DescriptionCVE.org

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted mp4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Executive ViewAI

Why It Matters

NGINX Open Source and NGINX Plus contain a critical buffer vulnerability in MP4 file handling that could allow local, authenticated users to crash worker processes or potentially execute code on affected servers. Organizations running NGINX with MP4 streaming enabled face service disruption and potential data compromise, requiring immediate patching to protect availability and integrity.

Business Impact: High

Compensating Controls

Apply vendor patch. If immediate patching is unavailable: disable the mp4 directive in NGINX configuration files and reload/restart NGINX; restrict local system access to trusted administrators only; implement file upload validation to reject non-standard MP4 formats if user uploads are processed.

Threat Intelligence Overview

EPSS Score

0.0%

Top 99% exploitable

Data Quality

7 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

No

Human Impact

High

Technical Impact

Total

Priority Score

42

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +42

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Related Vulnerabilities in NGINX Multiple Module Vulnerabilities

View all 6

CVE-2026-28753 MEDIUM

CVE-2026-28755 MEDIUM

CVE-2026-27651 HIGH

CVE-2026-27784 HIGH

CVE-2026-27654 HIGH POC

More in Nginx Open Source

View all

CVE-2026-42945 CRITICAL Act Now POC

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker

CVE-2026-42530 CRITICAL Act Now POC

Use-after-free in NGINX Open Source's ngx_http_v3_module allows remote unauthenticated attackers to crash worker process

CVE-2026-42055 CRITICAL Act Now POC

Heap-based buffer overflow in NGINX Plus and NGINX Open Source affects deployments that proxy HTTP/2 or gRPC traffic ups

CVE-2026-9256 CRITICAL Act Now POC

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module can be triggered by unauthenticated rem

CVE-2026-42533 CRITICAL Act Now POC

Heap buffer overflow in NGINX Plus and NGINX Open Source lets unauthenticated remote attackers crash worker processes (D

CVE-2026-93479 CRITICAL Act Now POC

Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by crafted HTTP requests when a non-default ma

CVE-2026-15176 CRITICAL Act Now POC

Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by unauthenticated remote attackers through cr

CVE-2026-97205 CRITICAL Act Now POC

Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O

CVE-2026-60005 HIGH This Week

Limited memory disclosure and worker-process restart in NGINX Plus and NGINX Open Source arise when the optional ngx_htt

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

CVE-2016-5198 HIGH POC

CVE-2025-5777 CRITICAL POC

CVE-2016-1646 HIGH POC

CVE-2017-5030 HIGH POC

CVE-2016-4523 HIGH

CVE-2024-48456 HIGH POC

CVE-2024-48457 HIGH POC

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

CVE-2017-7269 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2023-3519 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2016-4117 CRITICAL POC

CVE-2015-3113 CRITICAL POC

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Liberty Linux 10	Fixed
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:6906 ADVISORY https://access.redhat.com/errata/RHSA-2026:6907 ADVISORY https://access.redhat.com/errata/RHSA-2026:6923 ADVISORY https://access.redhat.com/errata/RHSA-2026:7002 ADVISORY https://access.redhat.com/errata/RHSA-2026:7343 ADVISORY https://my.f5.com/manage/s/article/K000160366 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-32647 ADVISORY https://ubuntu.com/security/notices/USN-8375-1 ADVISORY https://vuldb.com/vuln/352783 REF https://access.redhat.com/errata/RHSA-2026:10065 REF https://access.redhat.com/errata/RHSA-2026:13634 REF https://access.redhat.com/errata/RHSA-2026:13680 REF https://access.redhat.com/errata/RHSA-2026:13839 REF https://access.redhat.com/errata/RHSA-2026:14836 REF https://access.redhat.com/errata/RHSA-2026:15942 REF https://access.redhat.com/errata/RHSA-2026:15943 REF https://access.redhat.com/errata/RHSA-2026:15945 REF https://access.redhat.com/errata/RHSA-2026:15966 REF https://access.redhat.com/errata/RHSA-2026:8346 REF https://access.redhat.com/security/cve/CVE-2026-32647 REF https://bugzilla.redhat.com/show_bug.cgi?id=2449598 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32647.json

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy