CVE-2026-27784 is an integer overflow or wraparound vulnerability classified under CWE-190, found in the ngx_http_mp4_module of the 32-bit implementation of F5's NGINX Open Source. This module handles MP4 streaming and processing. The flaw arises when processing specially crafted MP4 files, causing the module to miscalculate buffer sizes or offsets due to integer overflow, leading to out-of-bounds memory access. This can result in over-reading or overwriting the memory space allocated to NGINX worker processes, potentially causing worker termination (denial of service) or enabling an attacker to corrupt memory in a way that could lead to arbitrary code execution or privilege escalation. The vulnerability is limited to 32-bit builds where the mp4 directive is enabled in the configuration, and the affected versions are 1.29.0 and 1.1.19. Exploitation requires the attacker to have the ability to trigger processing of a malicious MP4 file, which implies some level of access to the HTTP service. The CVSS v3.1 score is 7.8, reflecting high impact on confidentiality, integrity, and availability, with low attack complexity and limited privileges required but no user interaction. No patches were linked in the provided data, and no known exploits have been observed in the wild as of the publication date.

The vulnerability can lead to denial of service by crashing NGINX worker processes, disrupting web services relying on MP4 streaming. More critically, memory corruption could allow attackers to execute arbitrary code or escalate privileges within the NGINX process context, potentially compromising the underlying server and network. Organizations using 32-bit NGINX Open Source with the mp4 module enabled are at risk of service outages and data breaches. Given the high confidentiality, integrity, and availability impacts, exploitation could affect sensitive data confidentiality and service reliability. Although 32-bit deployments are less common, legacy systems or embedded devices may still be vulnerable. The lack of known exploits reduces immediate risk but does not eliminate the threat, especially as attackers may develop exploits over time.

Organizations should first verify if they are running 32-bit versions of NGINX Open Source with the ngx_http_mp4_module enabled and the mp4 directive configured. If so, immediate mitigation includes disabling the mp4 module or the mp4 directive to prevent processing of MP4 files until a patch is available. Upgrading to a 64-bit version of NGINX Open Source, which is not affected, is strongly recommended. Monitoring HTTP logs for unusual MP4 file requests and implementing strict input validation or filtering on MP4 content can reduce exposure. Employing runtime protections such as memory safety tools or sandboxing NGINX worker processes may limit exploitation impact. Regularly check for official patches or updates from F5 and apply them promptly once released. Additionally, restrict access to the HTTP service to trusted users and networks to reduce the attack surface.