CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
Other sources
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Plex Media Serverto a version that resolves this vulnerability.Fixed in 1.43.3.10861 - Compensating control
Discontinue use of Plex Media Server if mitigations are unavailable.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs administrative access to Plex Media Server. The attack can be performed remotely over the network and does not require user interaction.
Are default installations affected?
The available information does not state whether TranscoderH264Options is configured by default. Exploitation depends on an administrator being able to set this preference and cause a transcode.
Why can an arbitrary file write lead to code execution?
At startup, Plex Media Server runs all .so files without checking signatures, execute permissions, or expected symbols. An administrator who can write a malicious shared object into a location loaded at startup may have it executed.
What version fixes the issue?
Plex Media Server versions before 1.43.3.10861 are affected. Upgrade to 1.43.3.10861 or later.