PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53423 membraneframework CVE debrief

CVE-2026-53423 is a medium-severity vulnerability in the membraneframework membrane_mp4_plugin. The vulnerability allows unauthenticated attackers to cause a denial-of-service (DoS) by exhausting the BEAM atom table. This occurs because the MP4 box header parser converts each 4-byte box name to an atom using String.to_atom/1 without validation, leading to permanent allocation of unique attacker-controlled 4-byte names. A crafted MP4 file of approximately 8 MB with around 1.1 million boxes with distinct non-standard names can exhaust the atom table, aborting the entire BEAM node and taking down all applications running on it. The vulnerability affects membrane_mp4_plugin versions from 0.3.0 before 0.36.7.

Vendor
membraneframework
Product
membrane_mp4_plugin
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-11
Original CVE updated
2026-06-11
Advisory published
2026-06-11
Advisory updated
2026-06-11

Who should care

Users of membraneframework membrane_mp4_plugin, particularly those using versions between 0.3.0 and 0.36.7, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability is caused by the lack of validation in the MP4 box header parser, which converts 4-byte box names to atoms without checking for uniqueness or limits. This leads to a permanent allocation of atoms, which can exhaust the atom table and cause a DoS.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update membrane_mp4_plugin to version 0.36.7 or later.
  • Limit the number of unique box names in MP4 files to prevent atom table exhaustion.
  • Monitor for suspicious MP4 files and implement validation for box names.

Evidence notes

The vulnerability was reported by an unknown vendor and has a CVSS score of 5.9. The CVE record and NVD detail can be found at [cve-org] and [nvd], respectively.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-53423 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-53423

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-53423 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-53423

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://cna.erlef.org/cves/CVE-2026-53423.html

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/membraneframework/membrane_mp4_plugin/commit/56373d1ddc86968e55fbde795c14eeba24357b57

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/membraneframework/membrane_mp4_plugin/security/advisories/GHSA-43hj-fxwj-49qw

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://osv.dev/vulnerability/EEF-CVE-2026-53423

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.