Threat Advisory

Membrane Flaw Results in Node Interruption and Atom Table Consumption

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: Medium
[subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

A vulnerability, identified as CVE-2026-53423 with a CVSS score of 5.9, exists in the membrane_mp4_plugin module. This flaw allows an attacker to crash the entire BEAM node hosting that pipeline through an unauthenticated denial-of-service attack by exhausting the BEAM atom table. The issue occurs when the MP4 container parser processes the input stream box-by-box and extracts the 4-byte name field without validating it against an allow-list, resulting in permanent allocations in the global atom table for every distinct attacker-controlled 4-byte sequence. The vulnerability can be exploited by delivering a specially crafted MP4 file to systems that demux user-supplied media using this plugin, causing the BEAM node to crash and impacting all Erlang/Elixir applications sharing the same runtime.

RECOMMENDATION:

We recommend you to update membrane_mp4_plugin to version 0.36.10 or later.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

A vulnerability, identified as CVE-2026-53423 with a CVSS score of 5.9, exists in the membrane_mp4_plugin module. This flaw allows an attacker to crash the entire BEAM node hosting that pipeline through an unauthenticated denial-of-service attack by exhausting the BEAM atom table. The issue occurs when the MP4 container parser processes the input stream box-by-box and extracts the 4-byte name field without validating it against an allow-list, resulting in permanent allocations in the global atom table for every distinct attacker-controlled 4-byte sequence. The vulnerability can be exploited by delivering a specially crafted MP4 file to systems that demux user-supplied media using this plugin, causing the BEAM node to crash and impacting all Erlang/Elixir applications sharing the same runtime.

RECOMMENDATION:

We recommend you to update membrane_mp4_plugin to version 0.36.10 or later.[emaillocker id="1283"]

REFERENCES:

The following reports contain further technical details:

[/emaillocker]
crossmenu