On this page

Atomicorp WAF Rule 398125

Rule Summary

  • Rule ID: 398125
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules: Plex Media Server arbitrary file write - x264 output option in TranscoderH264Options (CVE-2026-96656)
  • Observed CWEs: None documented
  • Revision: 1
  • Rule severity: Critical (2)
  • Phase: 2 (request body)
  • Request surfaces: Request arguments, JSON request data, SOAP request data
  • Rule action: deny
  • HTTP status: 403
  • Public tags: CVE-2026-96656, plex
  • Logging: log, auditlog

Description

This rule detects behavior identified by its current alert as “Plex Media Server arbitrary file write - x264 output option in TranscoderH264Options (CVE-2026-96656)” in the request arguments, JSON request data, SOAP request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.

CVEs Referenced by This Rule

The current ModSecurity rule metadata explicitly names the following CVEs. These references explain the rule author’s association; they do not claim that the rule is limited to these vulnerabilities or that this is an exhaustive coverage list.

CVE-2026-96656

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264’s option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.