CVE-2022-41741

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source
Subscription before versions R2 P1 and R1 P1, and NGINX Plus before
versions R27 P1 and R26 P1 have a vulnerability in the module
ngx_http_mp4_module that might allow a local attacker to corrupt NGINX
worker memory, resulting in its termination or potential other impact using
a specially crafted audio or video file. The issue affects only NGINX
products that are built with the ngx_http_mp4_module, when the mp4
directive is used in the configuration file. Further, the attack is
possible only if an attacker can trigger processing of a specially crafted
audio or video file with the module ngx_http_mp4_module.