A flaw in the 32‑bit build of NGINX Open Source within the ngx_http_mp4_module allows an attacker to supply a specially crafted MP4 file that causes the module to read or write outside its intended bounds. The resulting overflow corrupts worker memory, leading the NGINX worker process to terminate. The weakness is a classic integer or arithmetic error, identified as CWE‑190, and it does not directly expose data or enable code execution. The outcome is a loss of service when the worker crashes.

The vulnerability applies to 32‑bit F5 NGINX Open Source installations that were built with the ngx_http_mp4_module and have the mp4 directive enabled in their configuration. No specific version ranges are listed, so any configured 32‑bit build that serves MP4 files is in scope.

The CVSS score of 8.5 indicates high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation, and the vulnerability is not present in the CISA KEV catalog. Attackers must be able to deliver a malicious MP4 file to a server that processes it with the ngx_http_mp4_module; if the conditions are met, the server will crash, causing a denial of service to legitimate users.