Skip to main content

Nginx Open Source EUVDEUVD-2026-14883

| CVE-2026-27784 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-03-24 f5 GHSA-hwq5-42j9-jvqj
Information Disclosure Integer Overflow Nginx Nginx Open Source F5
8.5
CVSS 4.0 · Vendor: f5
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Upload specially crafted MP4 file
  2. Delivery
    NGINX mp4 module parses file
  3. Exploit
    Integer overflow in 32-bit calculation
  4. Execution
    Memory over-read/over-write
  5. Impact
    Worker process termination

Vulnerability Assessment

Weakness
CWE
CWE-190
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires 32-bit NGINX Open Source built with ngx_http_mp4_module enabled and mp4 directive configured. Attacker needs local low-privilege access to trigger processing of a specially crafted MP4 file through the module.
Impact

The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a local attack vector requiring low privileges and low complexity, with high impact across confidentiality, integrity, and availability. However, the local attack vector significantly constrains real-world exploitation scenarios compared to network-based vulnerabilities. The attacker must already have local access with sufficient privileges to trigger MP4 file processing, which typically means either authenticated file upload capabilities or filesystem access to place malicious files. The specificity of affected systems (32-bit only, with mp4 module enabled) further narrows the attack surface, as most modern NGINX deployments run on 64-bit architectures. No EPSS score or KEV status is provided in the intelligence, and no public proof-of-concept is mentioned, suggesting limited active exploitation. While the CVSS score of 7.8 appears high, the practical risk is moderate and primarily concerns legacy 32-bit systems with video streaming functionality where untrusted users can upload or specify MP4 files for processing. The vulnerability represents a priority for organizations running 32-bit NGINX with MP4 module in multi-tenant or user-content scenarios, but is lower priority for typical web server deployments.
Exploit ScenarioDerived

An attacker with low-level local access to a system running 32-bit NGINX with MP4 module enabled crafts a malicious MP4 file with metadata values designed to trigger integer overflow when parsed by the ngx_http_mp4_module. The attacker either uploads this file through a web application that stores user content, places it directly on the filesystem if they have local access, or tricks an administrator into processing it. When NGINX attempts to serve or parse the MP4 file, the integer overflow causes out-of-bounds memory reads or writes in the worker process, potentially exposing sensitive memory contents, corrupting data structures, or crashing the worker, resulting in denial of service or possible code execution depending on memory layout.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 24, 2026

Integer overflow in NGINX 32-bit builds with the ngx_http_mp4_module allows local attackers to corrupt or overwrite worker process memory via specially crafted MP4 files, leading to denial of service. The vulnerability requires the mp4 directive to be enabled in the configuration and an attacker's ability to trigger MP4 file processing. No patch is currently available for affected deployments.

Earlier versions of this analysis (1)
v1 Mar 24, 2026 - 14:45 CVSS 8.5

A memory corruption vulnerability exists in the ngx_http_mp4_module of 32-bit NGINX Open Source that allows attackers to over-read or over-write worker memory, resulting in process termination. The vulnerability affects only 32-bit builds with the mp4 module enabled and the mp4 directive configured, requiring the attacker to trigger processing of a specially crafted MP4 file. With a CVSS score of 7.8 and local attack vector requiring low privileges, this represents a moderate risk primarily in environments where untrusted users can upload MP4 files to 32-bit NGINX installations.

RemediationAI

Consult the F5 security advisory at https://my.f5.com/manage/s/article/K000160364 for specific patched versions of NGINX Open Source and upgrade immediately to the recommended release that addresses this integer overflow vulnerability. If immediate patching is not feasible, implement the following mitigations: migrate 32-bit NGINX installations to 64-bit architectures where the vulnerability does not manifest, disable the ngx_http_mp4_module or remove the mp4 directive from configuration files if MP4 pseudo-streaming is not required, implement strict input validation and file type restrictions to prevent processing of untrusted MP4 files, or isolate the NGINX worker processes using operating system-level sandboxing mechanisms such as seccomp, AppArmor, or SELinux to limit the impact of memory corruption. Organizations should prioritize migration to 64-bit systems as 32-bit architectures are increasingly deprecated and receive reduced security support.

Affected VersionsENISA

NGINX Open Source 1.29.0 <1.29.7
NGINX Open Source 1.1.19 <1.28.3

Affected Packages

euvd nginx_open_source fix: 1.28.3, 1.29.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability resides in NGINX Open Source's ngx_http_mp4_module, a module designed to serve MP4 video files with seeking support and pseudo-streaming capabilities. The affected product is identified via CPE cpe:2.3:a:f5:nginx_open_source and is specifically limited to 32-bit architectures. The root cause is classified as CWE-190 (Integer Overflow or Wraparound), indicating that arithmetic operations on MP4 file metadata likely exceed 32-bit integer boundaries, leading to memory corruption. The ngx_http_mp4_module parses MP4 container metadata to enable features like byte-range requests and seeking, and improper validation of these values on 32-bit systems allows crafted files to trigger out-of-bounds memory access. The vulnerability only manifests when the mp4 directive is explicitly enabled in the NGINX configuration, meaning many deployments using NGINX for reverse proxying or static file serving without MP4 pseudo-streaming are not affected.

Know when Nginx Open Source gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (f5) PRIMARY 8.5 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.5 HIGH

Primary rating from Vendor (f5).

CVSS VectorVendor: f5

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch released
Apr 10, 2026 - 08:30 nvd
Patch available
CVE Published
Mar 24, 2026 - 14:13 nvd
HIGH 8.5

DescriptionCVE.org

The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Executive ViewAI

Why It Matters

A memory corruption vulnerability in NGINX's MP4 processing module (CVE-2026-27784) affects 32-bit server installations and could allow attackers to crash services by uploading malicious MP4 files. Organizations running 32-bit NGINX with MP4 functionality enabled should assess their exposure immediately, as no vendor patch is currently available and workarounds are required to maintain service availability.

Business Impact: Medium
Compensating Controls

Disable the ngx_http_mp4_module if not operationally required; implement WAF rules to reject MP4 uploads with malformed headers; restrict MP4 file uploads to authenticated users only; segment NGINX services to prevent untrusted user uploads; migrate vulnerable 32-bit NGINX installations to 64-bit builds; monitor NGINX error logs for worker process terminations.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Defer
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
Medium
Technical Impact
Partial

Priority Score

42
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +42
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in NGINX Multiple Module Vulnerabilities

View all 6
CVE-2026-28753 MEDIUM
6.3
CVE-2026-28755 MEDIUM
5.3
CVE-2026-27651 HIGH
8.7
CVE-2026-32647 HIGH
8.5
CVE-2026-27654 HIGH POC
8.8

More in Nginx Open Source

View all
CVE-2026-42945 CRITICAL POC
9.2 May 13

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker
CVE-2026-42530 CRITICAL POC
9.2 Jun 17

Use-after-free in NGINX Open Source's ngx_http_v3_module allows remote unauthenticated attackers to crash worker process
CVE-2026-42055 CRITICAL POC
9.2 Jun 17

Heap-based buffer overflow in NGINX Plus and NGINX Open Source affects deployments that proxy HTTP/2 or gRPC traffic ups
CVE-2026-9256 CRITICAL POC
9.2 May 22

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module can be triggered by unauthenticated rem
CVE-2026-42533 CRITICAL POC
9.2 Jul 15

Heap buffer overflow in NGINX Plus and NGINX Open Source lets unauthenticated remote attackers crash worker processes (D
CVE-2026-93479 CRITICAL POC
9.2 Oct 14

Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by crafted HTTP requests when a non-default ma
CVE-2026-15176 CRITICAL POC
9.2 Oct 14

Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by unauthenticated remote attackers through cr
CVE-2026-97205 CRITICAL POC
9.2 Oct 14

Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O
CVE-2026-60005 HIGH
8.8 Jul 15

Limited memory disclosure and worker-process restart in NGINX Plus and NGINX Open Source arise when the optional ngx_htt

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2026-97229 CRITICAL POC
10.0
CVE-2017-7529 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 8 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:6906 ADVISORY https://access.redhat.com/errata/RHSA-2026:6907 ADVISORY https://access.redhat.com/errata/RHSA-2026:6923 ADVISORY https://access.redhat.com/errata/RHSA-2026:7002 ADVISORY https://access.redhat.com/errata/RHSA-2026:7343 ADVISORY https://my.f5.com/manage/s/article/K000160364 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-27784 ADVISORY https://ubuntu.com/security/notices/USN-8375-1 ADVISORY https://vuldb.com/vuln/352784 REF https://access.redhat.com/errata/RHSA-2026:10065 REF https://access.redhat.com/errata/RHSA-2026:13634 REF https://access.redhat.com/errata/RHSA-2026:13680 REF https://access.redhat.com/errata/RHSA-2026:13839 REF https://access.redhat.com/errata/RHSA-2026:14836 REF https://access.redhat.com/errata/RHSA-2026:15942 REF https://access.redhat.com/errata/RHSA-2026:15943 REF https://access.redhat.com/errata/RHSA-2026:15945 REF https://access.redhat.com/errata/RHSA-2026:15966 REF https://access.redhat.com/errata/RHSA-2026:8346 REF https://access.redhat.com/security/cve/CVE-2026-27784 REF https://bugzilla.redhat.com/show_bug.cgi?id=2450785 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27784.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy