CVE-2026-96656

Plex Media Server arbitrary file write

high · 8.6

Known exploited

Fix listed

Plex Media Server

Published Sep 23, 2026, 16:07 UTC

Description

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

Reported fixed versions

1.43.3.10861

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.