CVE-2026-32647: 
NGINX vulnerability analysis and mitigation

CVE-2026-32647 is a buffer over-read/over-write vulnerability in the ngx_http_mp4_module module of NGINX Open Source and NGINX Plus. An attacker who can trigger processing of a specially crafted MP4 file through the vulnerable module may cause NGINX worker process termination or potentially achieve arbitrary code execution. The vulnerability was published on March 24, 2026, and affects NGINX Open Source versions 1.1.19 through 1.28.2 and 1.29.0 through 1.29.6, as well as NGINX Plus R32 through R36 (various patch levels). It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (F5 Advisory, Red Hat CVE).

The root cause is classified as CWE-125 (Out-of-bounds Read), with the possibility of an over-write condition as well, within the ngx_http_mp4_module module. Exploitation requires local access (attack vector: local) with low privileges, and no user interaction — an attacker must be able to supply or trigger the processing of a maliciously crafted MP4 file by an NGINX instance that has both the ngx_http_mp4_module compiled in and the mp4 directive enabled in its configuration. The vulnerability is mapped to CAPEC-540 (Overread Buffers), indicating the attacker manipulates MP4 file metadata or structure to cause the NGINX worker to read or write beyond allocated memory boundaries (F5 Advisory, Red Hat CVE).

Successful exploitation can result in termination of the NGINX worker process (denial of service) or, in more severe cases, arbitrary code execution with the privileges of the NGINX worker process. Confidentiality, integrity, and availability are all rated High impact under CVSS v3.1. The scope is limited to the affected NGINX worker process and does not directly propagate to other system components, but code execution as the worker process could enable further lateral movement or data access depending on the deployment environment (F5 Advisory).

1. Reconnaissance: Identify NGINX instances (Open Source or Plus) that are built with ngx_http_mp4_module and have the mp4 directive enabled in their configuration. This can be done by reviewing server responses or configuration files if accessible.
2. Precondition verification: Confirm local access to the target system (e.g., via a shell account or the ability to upload files to a directory served by NGINX with the mp4 module active).
3. Craft malicious MP4 file: Create a specially crafted MP4 file with malformed metadata or structure (e.g., manipulated atom sizes, offsets, or headers) designed to trigger an out-of-bounds read or write when parsed by ngx_http_mp4_module.
4. Trigger processing: Place the crafted MP4 file in a location accessible to the NGINX mp4 module and issue an HTTP request (e.g., GET /path/to/malicious.mp4) that causes NGINX to process the file through the vulnerable module.
5. Achieve impact: Depending on the memory layout and exploitation precision, the result is either a worker process crash (DoS) or, in a more targeted scenario, arbitrary code execution within the NGINX worker process context (F5 Advisory).

• Logs: Unexpected NGINX worker process crashes or restarts logged in /var/log/nginx/error.log (e.g., worker process exited on signal 11 indicating a segmentation fault); repeated HTTP requests for MP4 files from unusual or unexpected source IPs.
• Process: NGINX worker processes terminating abnormally or spawning unexpected child processes; core dump files generated in the NGINX working directory following a crash.
• File System: Presence of unusual or malformed .mp4 files in directories served by NGINX with the mp4 module enabled; unexpected files written to NGINX working directories if code execution was achieved.
• Network: Unusual HTTP GET requests targeting MP4 file paths from low-privilege local users or unexpected external sources, particularly with large or malformed Range headers.

F5 has released patched versions: NGINX Open Source 1.28.3 (stable branch) and 1.29.7 (mainline branch); NGINX Plus R32 P5 or later, R35 P2 or later, and R36 P3 or later. Upgrading to a patched version is the recommended remediation. If immediate patching is not feasible, disable the mp4 directive in the NGINX configuration file to prevent the vulnerable code path from being triggered, or restrict access to MP4 processing endpoints to trusted sources only. Multiple Linux distribution vendors (Red Hat, SUSE, Ubuntu, Debian, Amazon Linux) have also released updated packages (F5 Advisory, Red Hat CVE, NGINX Releases).

Security news outlets including GBHackers, CyberSecurityNews, and SecurityOnline covered the vulnerability shortly after disclosure, highlighting the potential for remote code execution via MP4 file processing (GBHackers, CyberSecurityNews). The vulnerability was also discussed in the oss-security mailing list (oss-sec). Community reaction has been measured, with the primary focus on patching given the local attack vector requirement and absence of public exploits. The Hacker News weekly recap included the vulnerability in its threat landscape summary.