CVE-2026-96656: Plex Media Server arbitrary file write
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs administrative access to Plex Media Server. The attack can be performed remotely over the network and does not require user interaction.
Are default installations affected?
The available information does not state whether TranscoderH264Options is configured by default. Exploitation depends on an administrator being able to set this preference and cause a transcode.
Why can an arbitrary file write lead to code execution?
At startup, Plex Media Server runs all .so files without checking signatures, execute permissions, or expected symbols. An administrator who can write a malicious shared object into a location loaded at startup may have it executed.
What version fixes the issue?
Plex Media Server versions before 1.43.3.10861 are affected. Upgrade to 1.43.3.10861 or later.