From preference string to executed library: the Plex TranscoderH264Options write

The highest CVSS score in the Plex Media Server patch belongs to CVE-2026-96656, and its description explains why. The CNA records that an admin user can write arbitrary files that may be executed on load, because the TranscoderH264Options preference is appended verbatim to the x264 option string on every transcode and the server runs every .so file at startup without signature, execute-bit or symbol checks.

Vulnerability overview

CVE-2026-96656 is classified as CWE-73, external control of file name or path. The CNA assigns CVSS v3.1 7.2 with CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H and CVSS v4.0 8.6, with high privileges required.…