The vulnerability stems from the MP4 box header parser converting each four‑byte box name to a BEAM atom via String.to_atom/1 without validating the input. Each unique name is permanently interned; when an attacker supplies a crafted MP4 file laden with unique four‑byte identifiers, the atom table—whose limit is roughly one million atoms—is exhausted, causing the BEAM node to abort and all applications running on it to terminate. The effect is an unauthenticated denial‑of‑service.

The flaw affects the MembraneFramework membrane_mp4_plugin component. Versions from 0.3.0 up to but not including 0.36.7 are vulnerable. Any deployment that uses this plugin within the Membrane media pipeline and processes MP4 files from untrusted sources is at risk.

With a CVSS score of 5.9 the vulnerability is classified as moderate severity. The EPSS score is not available, and it is not listed in CISA’s KEV catalog. The likely attack vector is the transmission of a malicious MP4 file to the node—no authentication is required, simply any interface that accepts MP4 input. Once the atom table is exhausted, the entire BEAM node halts, leading to complete service disruption.