Plex Media Server Arbitrary File Write and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-96656)
Executive & SecOps Summary
SECOPS ASSESSMENTPlex Media Server versions prior to 1.43.3.10861.
An authenticated admin can exploit the TranscoderH264Options preference to write arbitrary files, leading to full system compromise via malicious library (.so) execution.
Immediately update to version 1.43.3.10861 or later and enforce Multi-Factor Authentication (MFA) for all admin accounts.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND- Immediate Update: Upgrade to Plex Media Server version 1.43.3.10861 or higher immediately.
- Enforce MFA: Secure all administrative accounts with Multi-Factor Authentication (MFA) to prevent unauthorized access to server preferences.
- Principle of Least Privilege: Ensure the user account running the Plex service has restricted write access to system and application library directories.
# Example: Checking current version on Linux
export PLEX_VERSION=$(dpkg -s plexmediaserver | grep '^Version:' | awk '{print $2}')
echo "Current Plex Version: $PLEX_VERSION"Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
The vulnerability (CWE-73) exists due to the 'TranscoderH264Options' preference being appended verbatim to the x264 command-line option string during transcoding processes. An attacker with administrative access can inject parameters to write arbitrary files to the host's disk. Crucially, Plex Media Server is designed to load and execute all shared object (.so) files found in its library path at startup without performing signature verification, execution bit checks, or symbol validation. This combination allows an arbitrary file write to escalate directly into persistent Remote Code Execution (RCE). Given its inclusion in the CISA KEV catalog and an EPSS score of 0.94, this vulnerability is being actively exploited in the wild.
Official Vendor Advisories & References
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.