---
id: CVE-2026-96656
title: >-
  Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary
  files that may be executed on load
summary: >-
  Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary
  files that may be executed on load. The preference TranscoderH264Options is
  appended verbatim to x264's option string on every transcode. At startup, all
  .so f…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-73
vendor: plex
product: media_server
affected:
  - media_server < 1.43.0.10861
patched:
  - media_server 1.43.0.10861
published: '2026-09-23'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T18:34:58.550'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-96656'
references:
  - url: 'https://forums.plex.tv/t/plex-media-server/30447/711'
    label: 9119a7d8-5eab-497f-8521-727c672e3725
  - url: >-
      https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
    label: 9119a7d8-5eab-497f-8521-727c672e3725
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-96656'
    label: 9119a7d8-5eab-497f-8521-727c672e3725
  - url: 'https://zmain.info/blog/plex2shell'
    label: 9119a7d8-5eab-497f-8521-727c672e3725
tags:
  - nvd
  - cve.org
  - exploit-available
  - in-the-wild
  - kev
epss: 0.01785
epssPercentile: 0.78187
ssvc:
  exploitation: active
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-20T19:46:34.862476Z'
ingestedAt: '2026-09-23T16:27:22.663Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/a3igner/plex-codec-cache-implant'
  checkedAt: '2026-10-27T19:24:31.001Z'
exploitAvailable: true
exploited: true
kev: true
kevDateAdded: '2026-10-20'
kevDueDate: '2026-10-23'
kevRansomware: false
---

## Overview

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

## Affected

- `media_server < 1.43.0.10861`

## Remediation

Upgrade past the affected range:

- `media_server 1.43.0.10861`