Plex Media Server 1.43.3.10861 - Arbit. File Write via TranscoderH264Options
CVE-2026-96656 Published on September 23, 2026
Plex Media Server arbitrary file write
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
Vulnerability Analysis
CVE-2026-96656 is exploitable with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
External Control of File Name or Path
The software allows user input to control or influence paths or file names that are used in filesystem operations.
Products Associated with CVE-2026-96656
Want to know whenever a new CVE is published for Plex Media Server? stack.watch will email you.
Affected Versions
Plex Media Server:- Before 1.43.3.10861 is affected.
- Version 1.43.3.10861 is unaffected.