Arbitrary File Writing Vulnerability in Plex Media Server by Plex

CVE-2026-96656

What is CVE-2026-96656?

Plex Media Server versions before 1.43.3.10861 are susceptible to a vulnerability that allows an admin user to write arbitrary files. This occurs because the preference TranscoderH264Options is appended to x264's option string during each transcoding process. At server startup, all .so files are executed without performing necessary checks, including signature validation or execute bit permissions. This can lead to potential execution of malicious code if improperly configured options are used.

References