Plex Media Server arbitrary file write (CVE-2026-96656)

The CVE record says Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to the option string of x264, the video encoder, on every transcode. At startup, all .so files are run without signature, execute bit or symbol checks.

On its own the flaw needs admin rights, and the score reflects that: the CVSS v3.1 vector sets privileges required to high. In the Plex2Shell chain an earlier step gives the attacker the owner's admin token, so an outsider reaches this step. The researcher says the result is code execution with the rights of the Plex process.

Plex says compromised servers were used to run cryptocurrency miners and proxy software. It lists unfamiliar .so or .dll files in the Plex Codecs folder as a sign of compromise.

Plex2Shell is the name for the chain of CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. CISA's entry for each one says it can be chained with the other three. Our Plex2Shell news post shows how the four steps fit together.

In our checks on 23 October 2026, a GitHub search for this CVE id returned 4 repositories, the earliest created on 17 October. By their descriptions they include the researcher's tool, a copy of it, a compromise checker and an incident write-up. We did not run or link any of them. Our dark web and chat monitoring found 4 Telegram posts naming this CVE between 17 and 21 October.

Plex Media Server before build 1.43.3.10861, according to the CVE record. Plex says 1.43.3.10861 and later are not affected.

Plex's post title says 1.43.2 and earlier, while its 19 October update gives the build number as the cutoff. Use the build number. The researcher's README names builds up to 1.43.3.10828 as vulnerable, so an early 1.43.3 build can still be affected.

Plex's update guide covers Windows, macOS, Linux, NAS devices and Docker. Plex says an internet-reachable server older than 1.43.3.10861 should be assumed possibly compromised.