CVE-2026-53423 is a CWE-770 vulnerability in the membrane_mp4_plugin of the membraneframework. The issue arises because the MP4 box header parser uses String.to_atom/1 on each 4-byte box name without validation, interning each unique box name as a BEAM atom. Since BEAM atoms are never garbage-collected, an attacker can craft an MP4 file containing approximately 1.1 million distinct box names, exhausting the atom table (default limit ~1,048,576 atoms). This leads to the BEAM node aborting and taking down all applications running on it. The vulnerability affects versions from 0.3.0 up to but excluding 0.36.7.

Successful exploitation results in denial-of-service by exhausting the BEAM atom table, causing the entire BEAM node to abort. This disrupts all applications running on the affected node. The vulnerability requires local access (AV:L) and has a medium CVSS score of 5.9. No remote or network vector is indicated, and no privilege is required. There is no indication of confidentiality, integrity, or availability impact beyond denial-of-service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is indicated in the provided data. Until a patch is available, avoid processing untrusted MP4 files with membrane_mp4_plugin versions 0.3.0 through before 0.36.7. Monitor vendor communications for updates and apply official fixes once released.