EN PT-BR
← Voltar ao feed
high

Synology patches Plex Media Server for DSM and Chat Client flaws, including Brotli-based CVE-2026-111497

1 fonte(s) · 1 atualização(ões) · publicado 08/11/2026 21:00 · coletado há 1 hora

Synology published two advisories covering DSM packages: Synology-SA-26:17 for Plex Media Server for DSM (named Plex2Shell, dated 8 November 2026 on synology.com) and Synology-SA-26:15 for the Synology Chat Client. The Plex advisory lists four CVEs, all rated Important by Synology, with CVSS 3.1 base scores from 4.3 to 7.2; three of them need an authenticated account, the highest-scored one (CVE-2026-96656, 7.2) needs an admin account, and only CVE-2026-96654 (6.5) needs no privileges. The Chat Client flaw, CVE-2026-111497, is a buffer overflow in the Google Brotli decoder affecting versions 1.0.3 through 1.2.0, which carries a 9.8 CVSS score at CVE level, yet Synology rates the Chat Client product as Moderate. Neither advisory states exploitation in the wild, and Synology lists no mitigation, so applying the fixed versions is the only remedy. Criticity is high: the unauthenticated memory-corruption flaw is serious, but the product-level severity, the absence of any stated exploitation and the admin requirement for the top Plex flaw limit the immediate urgency.

Entenda a falha

A vulnerabilidade

CVE-2026-111497 (CVSS 9.8) is a buffer overflow in the Google Brotli decoder, versions 1.0.3 to 1.2.0, used by the Synology Chat Client. A remote, unauthenticated attacker with a crafted compressed stream can corrupt decoder state, leak memory, cause denial of service or possibly run code. Fixed in Chat Client 1.2.5-0240; other Brotli builds should move to 1.0.10, 1.1.1 or 1.2.1. Synology rates the product itself as Moderate. Plex Media Server for DSM has four more CVEs, all rated Important: CVE-2026-96656 (7.2, needs admin, writes files that get executed), CVE-2026-96654 (6.5, no privileges, calls other plugins' functions), and CVE-2026-96652 and CVE-2026-96655 (4.3 each, SSRF for authenticated users). Fixed in Plex 1.43.5.11079-720011079 (DSM 7.3/7.4) and 1.43.5.11079-700011079 (DSM 7.2.1/7.2.2).

Como funciona

For the Brotli flaw, the Chat Client receives a compressed stream and passes it to the Brotli decoder. With a crafted stream, the decoder writes past the buffer it expects and its internal state is corrupted, which can expose memory, crash the client or in the worst case allow code execution. In Plex, the admin flaw works through the TranscoderH264Options preference, which is passed to x264, while the server loads every .so file at startup. The SSRF flaws make the server send requests to addresses the caller chooses, through '/player/timeline' and the transcode endpoint. The searchOne flaw lets URL values reach other plugins' functions.

Por que é vulnerável

The Brotli bug is classed as CWE-252 and is a memory-safety error in the decoder that the fixed Brotli releases correct. In Plex, the root causes are missing validation: the server runs every .so file at startup without signature or symbol checks (CWE-73), does not neutralize URL values in 'searchOne' (CWE-84), and does not restrict the destinations of server-side requests (CWE-918 for '/player/timeline'). The '/player/timeline' endpoint accepts any X-Plex-Token value. The articles do not explain why these went unnoticed.

Onde está

Per the story, the flaws are in the Brotli decoder (Chat Client), the TranscoderH264Options preference, 'searchOne', '/player/timeline' and the Plex transcode endpoint; no file or commit is named.

Como foi descoberta

The articles do not say who found the flaws or how. Synology disclosed them in advisory Synology-SA-26:17 (Plex, 8 November 2026) and Synology-SA-26:15 (Chat Client, first published 29 October 2026, updated 9 November 2026). CERT-FR published a notice on 9 November 2026 and dates SA-26:15 to that day, which is the update date rather than the first release. Neither advisory states exploitation in the wild.

Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 14:35.

Detalhes técnicos

  • CVE-2026-96656 (CVSS 3.1 7.2, CWE-73): an admin user can write files that are executed on load, because the TranscoderH264Options preference is passed to x264 and all .so files are run at startup without signature or symbol checks (synology.com).
  • CVE-2026-96654 (CVSS 3.1 6.5, CWE-84): unneutralized URL values in 'searchOne' let an attacker call other plugins' functions with attacker-supplied parameters, with no privileges required (synology.com).
  • CVE-2026-96652 (CVSS 3.1 4.3, CWE-918): SSRF through '/player/timeline', reachable with any X-Plex-Token value (synology.com).
  • CVE-2026-96655 (CVSS 3.1 4.3): an authenticated user can make the server request arbitrary internal or external addresses through the transcode endpoint (synology.com).
  • CVE-2026-111497 (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N, CWE-252): a buffer overflow in the Brotli decoder in Google Brotli 1.0.3 to 1.2.0 lets a remote unauthenticated attacker corrupt decoder state, disclose memory, cause denial of service or potentially execute code with a crafted compressed stream (synology.com).

Remediação

  • Upgrade Plex Media Server for DSM 7.3 and 7.4 to 1.43.5.11079-720011079 or later, and DSM 7.2.1 and 7.2.2 to 1.43.5.11079-700011079 or later (synology.com).
  • Upgrade the Synology Chat Client to 1.2.5-0240 or later (synology.com).
  • For any other Brotli library or binary in the 1.0.3 to 1.2.0 range, move to 1.0.10, 1.1.1 or 1.2.1 (synology.com).

Relatos divergentes

  • The CERT-FR notice dates Synology-SA-26:15 to 9 November 2026 (cert.cyber.gouv.fr). The Synology advisory shows an initial publication on 29 October 2026 and a last update on 9 November 2026, so the later date is the update, not the first release (synology.com).

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 08/11/2026 21:00 · coletado 09/11 14:01 primeiro registro

    Synology patches Plex Media Server for DSM and Chat Client flaws, including Brotli-based CVE-2026-111497

    ler a análise desta fonte

    Synology published two advisories covering DSM packages: Synology-SA-26:17 for Plex Media Server for DSM (named Plex2Shell, dated 8 November 2026 on synology.com) and Synology-SA-26:15 for the Synology Chat Client. The Plex advisory lists four CVEs, all rated Important by Synology, with CVSS 3.1 base scores from 4.3 to 7.2; three of them need an authenticated account, the highest-scored one (CVE-2026-96656, 7.2) needs an admin account, and only CVE-2026-96654 (6.5) needs no privileges. The Chat Client flaw, CVE-2026-111497, is a buffer overflow in the Google Brotli decoder affecting versions 1.0.3 through 1.2.0, which carries a 9.8 CVSS score at CVE level, yet Synology rates the Chat Client product as Moderate. Neither advisory states exploitation in the wild, and Synology lists no mitigation, so applying the fixed versions is the only remedy. Criticity is high: the unauthenticated memory-corruption flaw is serious, but the product-level severity, the absence of any stated exploitation and the admin requirement for the top Plex flaw limit the immediate urgency.

    Technical Details

    • CVE-2026-96656 (CVSS 3.1 7.2, CWE-73): an admin user can write files that are executed on load, because the TranscoderH264Options preference is passed to x264 and all .so files are run at startup without signature or symbol checks (synology.com).
    • CVE-2026-96654 (CVSS 3.1 6.5, CWE-84): unneutralized URL values in 'searchOne' let an attacker call other plugins' functions with attacker-supplied parameters, with no privileges required (synology.com).
    • CVE-2026-96652 (CVSS 3.1 4.3, CWE-918): SSRF through '/player/timeline', reachable with any X-Plex-Token value (synology.com).
    • CVE-2026-96655 (CVSS 3.1 4.3): an authenticated user can make the server request arbitrary internal or external addresses through the transcode endpoint (synology.com).
    • CVE-2026-111497 (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N, CWE-252): a buffer overflow in the Brotli decoder in Google Brotli 1.0.3 to 1.2.0 lets a remote unauthenticated attacker corrupt decoder state, disclose memory, cause denial of service or potentially execute code with a crafted compressed stream (synology.com).

    Remediation

    • Upgrade Plex Media Server for DSM 7.3 and 7.4 to 1.43.5.11079-720011079 or later, and DSM 7.2.1 and 7.2.2 to 1.43.5.11079-700011079 or later (synology.com).
    • Upgrade the Synology Chat Client to 1.2.5-0240 or later (synology.com).
    • For any other Brotli library or binary in the 1.0.3 to 1.2.0 range, move to 1.0.10, 1.1.1 or 1.2.1 (synology.com).

    Conflicting Reports

    • The CERT-FR notice dates Synology-SA-26:15 to 9 November 2026 (cert.cyber.gouv.fr). The Synology advisory shows an initial publication on 29 October 2026 and a last update on 9 November 2026, so the later date is the update, not the first release (synology.com).