NGINX Open Source and NGINX Plus contain a flaw in the ngx_http_mp4_module that allows a specially crafted MP4 file to trigger a buffer over‑read or over‑write of worker memory. The resulting memory corruption can terminate the worker process or, in the worst case, enable arbitrary code execution within the NGINX worker’s context. This is a classic out‑of‑bounds read/write condition (CWE‑125).

The vulnerability affects all builds of F5's NGINX Open Source and NGINX Plus that include the ngx_http_mp4_module and use the mp4 directive in their configuration. Specific product versions are not listed, so any installed version built with the module is potentially vulnerable. The module is present in NGINX Plus releases from r32 onward, but all such builds are covered by the advisory.

The CVSS base score of 8.5 indicates high severity, but the EPSS score of less than 1% suggests that active exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to deliver a crafted MP4 file that flows through the ngx_http_mp4_module, limiting the threat to environments that serve MP4 traffic via this module. Nonetheless, a successful exploit could crash workers or provide code‑execution privileges, warranting prompt mitigation.