Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-32647

33
FAUCET Score

CVE-2026-32647 is a high-severity vulnerability affecting NGINX Open Source and NGINX Plus when configured with the ngx_http_mp4_module. An attacker can trigger a buffer over-read or over-write using a specially crafted MP4 file, potentially leading to NGINX worker termination or arbitrary code execution. This issue carries a CVSS score of 7.8 (High), indicating low attack complexity and high impact on system availability, confidentiality, and integrity. While there is no known public exploit code or evidence of active exploitation, the vulnerability has garnered some community discussion.

Impacted Technologies

VendorProductVersion(s)CPE
r32CPE matchmatch criteria
cpe:2.3:a:f5:nginx_plus:r32:p1:*:*:*:*:*:*
r32CPE matchmatch criteria
cpe:2.3:a:f5:nginx_plus:r32:p2:*:*:*:*:*:*
r32CPE matchmatch criteria
cpe:2.3:a:f5:nginx_plus:r32:p3:*:*:*:*:*:*
r32CPE matchmatch criteria
cpe:2.3:a:f5:nginx_plus:r32:p4:*:*:*:*:*:*
r33CPE matchmatch criteria
cpe:2.3:a:f5:nginx_plus:r33:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

8.5HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
LOCAL
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
VS Confidentiality
HIGH
VS Integrity
HIGH
VS Availability
HIGH
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.92%
Probability of exploitation in next 30 days
EPSS Percentile
56.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0092 is in the 91st percentile among its peer group of 17,061 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (8)

microsoftpatch availablevia msrc
Product: 21077-17086Fixed in: 1.22.1-16
microsoftpatch availablevia msrc
Product: azl3 nginx 1.28.2-1 on Azure Linux 3.0Fixed in: 1.28.3-1
microsoftpatch availablevia msrc
Product: cbl2 nginx 1.22.1-15 on CBL Mariner 2.0Fixed in: 1.22.1-16
microsoftpatch availablevia msrc
Product: 21076-17084Fixed in: 1.28.3-1
netgearpatch availablevia llm_extracted
Fixed in: 1.29.7+, 1.28.3+
power_bipatch availablevia llm_extracted
Fixed in: 1.28.3
jfrogvendor investigatingvia llm_extracted
Fixed in: 1.29.7
liferayvendor investigatingvia llm_extracted
Fixed in: 1.28.3

Vendor Advisories (5)

microsoft2026-Mar/CVE-2026-32647Important

NGINX ngx_http_mp4_module vulnerability

Mar 10, 2026
power_billm-power_bi-46bef16df7b221c0MEDIUM

Buffer overflow in the ngx_http_mp4_module

Jan 1, 2026
netgearllm-netgear-fff48be6d9ee1600MEDIUM

Buffer overflow in the ngx_http_mp4_module

liferayllm-liferay-4e96c85b0f5fe799MEDIUM

Buffer overflow in the ngx_http_mp4_module

jfrogllm-jfrog-8a4d627d5f08c659MEDIUM

Buffer overflow in the ngx_http_mp4_module

References

access.redhat.com / errata/RHSA-2026:10065
access.redhat.com / errata/RHSA-2026:13634
access.redhat.com / errata/RHSA-2026:13680
access.redhat.com / errata/RHSA-2026:13839
access.redhat.com / errata/RHSA-2026:14836
access.redhat.com / errata/RHSA-2026:15942
access.redhat.com / errata/RHSA-2026:15943
access.redhat.com / errata/RHSA-2026:15945
access.redhat.com / errata/RHSA-2026:15966
access.redhat.com / errata/RHSA-2026:6906
access.redhat.com / errata/RHSA-2026:6907
access.redhat.com / errata/RHSA-2026:6923
access.redhat.com / errata/RHSA-2026:7002
access.redhat.com / errata/RHSA-2026:7343
access.redhat.com / errata/RHSA-2026:8346
access.redhat.com / security/cve/CVE-2026-32647
bugzilla.redhat.com / show_bug.cgi
security.access.redhat.com / data/csaf/v2/vex/2026/cve-2026-32647.json
my.f5.com / manage/s/article/K000160366
Vendor Advisory