A memory corruption vulnerability in the NGINX Open Source 32-bit MP4 module poses a significant risk of service disruption through worker process termination.

This vulnerability is caused by an integer overflow in the ngx_http_mp4_module. An attacker with local access can trigger this flaw by providing a specially crafted MP4 file to be processed by the module, leading to memory over-read or over-write operations that terminate the NGINX worker process.

The vulnerability carries a CVSS score of 7.8, reflecting its potential to cause a complete denial of service for the NGINX worker process. While the exploitation requires local access and specific configuration, the resulting service termination could lead to significant operational downtime, impacting the availability of web services hosted on affected systems.

Immediate Action: Upgrade NGINX Open Source to version 1.29.7 or 1.28.3, or later, as provided by the vendor.

Proactive Monitoring: Monitor system logs for repeated NGINX worker process crashes or unexpected termination errors that coincide with MP4 processing requests.

Compensating Controls: If upgrading is not immediately feasible, disable the ngx_http_mp4_module in the NGINX configuration if it is not strictly required for business operations.

Public Exploit Available: No.

Given the potential for service instability and the availability of patched versions, organizations using 32-bit NGINX Open Source should prioritize applying the provided security updates. Administrators must verify if their current NGINX builds utilize the affected module and perform the necessary upgrades to eliminate the risk of process termination.