CVE-2026-96656

CVE-2026-96656 is an arbitrary file write by an admin user that can be executed on load. NVD says the TranscoderH264Options preference is appended verbatim to the x264 option string on every transcode, and at startup all .so files are loaded without signature, execute-bit or symbol checks.

It is the last link in the chain: it turns an owner token into code execution as the Plex service user. On its own it needs admin rights. It is one of four CVEs in the chain called Plex2Shell. The others are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655. Plex Media Server before 1.43.3.10861 is affected.

NVD lists CVSS 3.1 7.2 and CVSS 4.0 8.6 for this CVE. NVD maps it to CWE-73. The CVE was published on 23 September 2026.

A researcher published a write-up on 16 October 2026 and a repository that covers all four CVEs. ThreatWire has not run it. On 17 October 2026 another researcher reported seeing the published code used against an internet-facing honeypot that ran an older Plex version. That is one honeypot, not a confirmed mass campaign. See the ThreatWire article on the full chain for details.

The CVE is not in the CISA KEV catalog as of 19 October 2026.

What to do: update Plex Media Server to 1.43.3.10861 or newer and do not expose port 32400 to the internet unless you need to.