Plex Media Server arbitrary file write via transcoder preferences
Plex Media Server before 1.43.3.10861 lets an admin write arbitrary .so files via the TranscoderH264Options preference; the server loads all Codecs-directory .so files at startup without checks.
- Vendor
- Plex
- Product
- Plex Media Server
- CVSS
- 7.2
- EPSS (exploit probability)
- 0.4%
- Status
- patched
- Published
Is CVE-2026-96656 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-96656 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-20 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.4% (scored October 19, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-20. Full cross-catalog view: /kev-comparison
Plex Media Server before 1.43.3.10861 appends the TranscoderH264Options server preference verbatim to x264’s option string on every transcode. Because the server loads all .so files from the Codecs directory at startup without signature, execute-bit, or symbol checks, an admin user who can write a file to that path achieves code execution on next restart.
CVE-2026-96656 is the execution endpoint of a five-CVE chain dubbed “Plex2Shell” disclosed by researcher Zach Main in July 2026. The supporting flaws (CVE-2026-96651, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655) provide SSRF and path-traversal primitives that reduce the admin-access prerequisite to an unauthenticated path on exposed servers.
Active exploitation of the full chain was confirmed on October 16, 2026, one day after a public proof-of-concept went live. Attackers are deploying XMRig-based miners and a Linux proxy backdoor.
Affected versions: Plex Media Server before 1.43.3.10861.
Fix: Update to 1.43.3.10861 or any later release. Restrict management-interface access to trusted networks if immediate patching is not possible.
Other Plex CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2020-5741 Plex Media Server Remote Code Execution Vulnerability | [ HIGH ] | 7.2 | 72.9% |
