CVE-2026-27784

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-27784
The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://my.f5.com/manage/s/article/K000160364 Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*
History

30 Mar 2026, 13:59

Type Values Removed Values Added
Summary
  • (es) La implementación de 32 bits de NGINX Open Source tiene una vulnerabilidad en el módulo ngx_http_mp4_module, lo que podría permitir a un atacante leer en exceso o sobrescribir la memoria del proceso worker de NGINX, lo que resultaría en su terminación, utilizando un archivo MP4 especialmente diseñado. El problema solo afecta a NGINX Open Source de 32 bits si está compilado con el módulo ngx_http_mp4_module y la directiva mp4 se utiliza en el archivo de configuración. Además, el ataque es posible solo si un atacante puede desencadenar el procesamiento de un archivo MP4 especialmente diseñado con el módulo ngx_http_mp4_module. Nota: Las versiones de software que han alcanzado el Fin de Soporte Técnico (EoTS) no se evalúan.
References () https://my.f5.com/manage/s/article/K000160364 - () https://my.f5.com/manage/s/article/K000160364 - Mitigation, Vendor Advisory
CPE cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*
First Time F5 nginx Open Source
F5

24 Mar 2026, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-24 15:16

Updated : 2026-03-30 13:59

NVD link : CVE-2026-27784

Mitre link : CVE-2026-27784

CVE.ORG link : CVE-2026-27784

JSON object : View

Products Affected

f5

  • nginx_open_source
CWE
CWE-190

Integer Overflow or Wraparound