DEV Community

StarkMan
StarkMan

Posted on

From preference string to executed library: the Plex TranscoderH264Options write

#cybersecurity #infosec #security

From preference string to executed library: the Plex TranscoderH264Options write

The highest CVSS score in the Plex Media Server patch belongs to CVE-2026-96656, and its description explains why. The CNA records that an admin user can write arbitrary files that may be executed on load, because the TranscoderH264Options preference is appended verbatim to the x264 option string on every transcode and the server runs every .so file at startup without signature, execute-bit or symbol checks.

Vulnerability overview

CVE-2026-96656 is classified as CWE-73, external control of file name or path. The CNA assigns CVSS v3.1 7.2 with CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H and CVSS v4.0 8.6, with high privileges required. CISA's SSVC entry records Exploitation as none and Technical Impact as total.

Mechanism and exploitation conditions

The preference string reaches the x264 command line without validation, so an admin-level account can inject options that make the encoder write to a path of the attacker's choosing. Separately, the server loads shared objects from its plugin locations at startup and performs no integrity check on them. An attacker with admin rights combines the two steps: write a library through the encoder, then wait for a restart to have it loaded. Both steps require the same high privilege level, which is why the vector lists PR:H and why the score is high rather than critical.

Impact

Confidentiality, integrity and availability are all high. Code execution in the server's context gives access to the media library, to the configuration holding tokens and to every network the host can reach. Technical Impact rated as total by CISA's assessment reflects the same reading.

Affected products and scope

Plex Media Server versions below 1.43.3.10861 are affected. The flaw matters most where multiple administrators exist or where admin credentials are shared, because the starting point is an account with elevated rights rather than an anonymous request.

Exposure context

A ZoomEye query for app="Plex Media Server" returned 507,974 matching assets during preparation. That count describes product deployment and does not identify servers with weak admin hygiene, which is the precondition that matters here. The CVE filter for CVE-2026-96652 returned no matches, so CVE-indexed counting is not a substitute for asset inventory in this case.

Remediation and mitigations

Upgrade to 1.43.3.10861 or later. Reduce the number of admin accounts and rotate admin credentials, since the write step depends on that access. Restrict filesystem permissions on the plugin and codec directories so that the Plex process cannot write executable content into them, and monitor for new .so files since a fresh shared object is the visible step of this chain.

References

  1. CVE-2026-96656, https://www.cve.org/CVERecord?id=CVE-2026-96656
  2. CVE-2026-96652, https://www.cve.org/CVERecord?id=CVE-2026-96652
  3. CISA CSAF advisory va-26-266-01, https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
  4. Plex release notes, https://forums.plex.tv/t/plex-media-server/30447/711

Top comments (0)