High
Plex Media Server arbitrary file write
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
Announced Source revision 1
Original source ↗CVE-2026-96656
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-96656
Media Server
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Plex",
"product": "Media Server",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.43.3.10861",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.43.3.10861"
}
],
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2026-96656
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #45664 · Revision 1
- Added to Heist Feed
- Publisher date