CVE-2026-32647 is a CWE-125 out-of-bounds read vulnerability in the ngx_http_mp4_module of NGINX Open Source and NGINX Plus. When the mp4 directive is used, processing a specially crafted MP4 file can lead to buffer over-read or over-write in the worker memory, which may cause the NGINX worker process to terminate or allow code execution. This vulnerability requires that the attacker can trigger the processing of a malicious MP4 file. Red Hat has released security advisories and patches for affected NGINX packages in Red Hat Enterprise Linux 10.0 Extended Update Support.

Successful exploitation can result in high impact including denial of service due to worker process termination or potentially arbitrary code execution within the NGINX worker process. The vulnerability requires local access or the ability to cause the server to process a crafted MP4 file with the vulnerable module enabled. The CVSS v3.1 base score is 7.8, reflecting high confidentiality, integrity, and availability impact.

Red Hat has released security updates that fix this vulnerability in their NGINX packages for Red Hat Enterprise Linux 10.0 Extended Update Support. Users should apply these official patches as detailed in the Red Hat advisories (e.g., RHSA-2026:13634). Since this is not a cloud service, remediation depends on applying vendor-provided updates. Patch status is confirmed by Red Hat advisories. No indication of 'no action required' or 'already mitigated' is present, so applying the update is recommended.