The 32-bit implementation of NGINX Open Source contains an integer overflow or wraparound vulnerability in the ngx_http_mp4_module. When configured with the mp4 directive, processing a specially crafted MP4 file can cause an attacker to over-read or over-write memory in the NGINX worker process, resulting in its termination. This vulnerability is limited to 32-bit builds with the module enabled. Red Hat has issued security advisories and updates addressing this issue in their NGINX packages.

Successful exploitation can lead to denial of service by terminating NGINX worker processes due to memory corruption. The CVSS 3.1 base score is 7.8, indicating high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Red Hat has released security updates that fix this vulnerability. Users should apply the official patches provided in the Red Hat advisories (e.g., RHSA-2026:13634) to remediate the issue. Since this affects only 32-bit NGINX builds with ngx_http_mp4_module and the mp4 directive enabled, disabling the module or directive can also mitigate risk if patching is not immediately possible. Patch status is confirmed by Red Hat advisories; apply updates accordingly.