CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability

Two behaviors combine. The TranscoderH264Options preference goes unfiltered into x264's option string on each transcode, which gives an admin a way to make the transcoder write a file to a path of their choice (CWE-73). Then, at startup, Plex loads all .so files without checking a signature, the execute bit or symbols, so a file planted that way runs as the Plex process.

The CVSS vector requires high privileges (an admin), network access and no user interaction. On its own that is an admin-to-code-execution step. But CISA's KEV listing shows that it is used in real attacks, and a write-up on Plex honeypot traffic describes attackers chaining several Plex bugs for remote code execution. In that chain this bug plausibly turns a gained admin session into code execution, though the write-up I read does not detail it.

The honeypot saw payloads that included a cryptominer and a proxy tool, from servers with outbound internet access.

Affected: Plex Media Server before 1.43.3.10861, per the CVE record. You can find your version in the Plex web app under Settings, or on the server's status page. The Plex forum notice I read names 1.43.3.10828 as a July 2026 release and does not confirm the later fixed build, so check the downloads page.

NAS app stores such as QNAP may lag behind Plex's own releases, so confirm the build number there too.

Update Plex Media Server to 1.43.3.10861 or later, the first version the CVE record lists as not affected. Use plex.tv/media-server-downloads or your NAS vendor's app store.

CISA's required action: apply mitigations per vendor instructions, follow BOD 26-04 guidance and the forensics triage requirements, or discontinue use if mitigations are unavailable. The due date is 2026-10-23. It binds US federal agencies.

As hardening, limit admin accounts, do not expose port 32400 directly to the internet, and restrict outbound connections from the Plex host. These come from general practice, not from the vendor.

Look for unexpected .so files in the Plex install and data directories, especially recent ones, and changes to the TranscoderH264Options preference in Preferences.xml. Review transcoder logs for odd x264 options. The honeypot write-up reports exploit requests to /player/timeline/subscribe with a Python-urllib/3.10 user agent, and payloads including a cryptominer (xmrig) from source IP 217.60.194.116. Check for unknown processes and outbound connections from the Plex host.

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.