The vulnerability arises from the membrane_mp4_plugin's MP4 box header parser using String.to_atom/1 on each 4-byte box name encountered during parsing without validation or throttling. Since BEAM atoms are permanent and not garbage-collected, an attacker can supply a malicious MP4 file containing approximately 1.1 million distinct box names, exhausting the atom table (default limit ~1,048,576 atoms). This resource exhaustion leads to the BEAM node aborting, resulting in a denial-of-service affecting all applications on that node. The issue affects versions from 0.3.0 up to but not including 0.36.7.

Successful exploitation results in a denial-of-service condition by exhausting the BEAM atom table, causing the entire BEAM node to abort. This disrupts all applications running on the affected node. The vulnerability requires local access (AV:L) and partial attack complexity (AC:L), but no privileges or user interaction. The impact is high on availability but does not affect confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is documented in the provided data. Until a patch is available, avoid processing untrusted MP4 files with the vulnerable membrane_mp4_plugin versions. Monitor vendor channels for updates and apply official fixes once released.