CVE-2022-41741 - CVE House

Back to Database

Status published High CVE-2022-41741

NGINX ngx_http_mp4_module vulnerability CVE-2022-41741

7 CVSS

Vulnerability Description

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-41741

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from F5

View All →

TMM vulnerability

BIG-IP SSL/TLS vulnerability

BIG-IP APM portal access vulnerability

BIG-IP TMSH vulnerability

F5OS vulnerability

Affected Vendor

F5

View all reports →

Affected Software

NGINX, NGINX Plus, NGINX Open Source Subscription

Vulnerable Versions:

Mainline, Stable, R27, R1, R2

Timeline

Official Publish: October 19th, 2022

Last Modified: May 8th, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1055 Process Injection

Defense Evasion

T1105 Ingress Tool Transfer

Command and Control

T1485 Data Destruction