Plex Media Server CVE-2026-96656

Requires admin-level authentication to the Plex Media Server management interface (PR:H) - this is not exploitable by anonymous or standard users. Given that access, the attacker either (a) sets the TranscoderH264Options preference, whose value is appended verbatim to x264's option string on every transcode, or (b) writes a malicious .so file into a location loaded at startup, where all .so files are executed with no signature, execute-bit, or symbol checks. Exploitation is limited to servers running a version before 1.43.3.10861 and depends on the attacker first obtaining admin credentials or a valid admin session; because Plex admin is frequently the single server-owner account, the realistic path is credential compromise or exposure of the admin interface to untrusted networks. Execution is triggered by the next transcode operation or a server restart.

This is a genuine but privilege-gated code-execution flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) scores 8.6 and confirms full technical impact (confidentiality, integrity and availability of the vulnerable system) reachable over the network with low complexity - but PR:H means it requires an already-authenticated ADMIN of the Plex Media Server. It is therefore an admin-to-host-RCE / privilege-to-code-execution issue, not an unauthenticated pre-auth compromise, which meaningfully lowers real-world urgency versus the raw 8.6 headline. No EPSS score, KEV listing, or SSVC decision data was supplied, so exploitation probability and automatability cannot be quantified from the input. A referenced third-party writeup titled 'plex2shell' (zmain.info) strongly implies the technique is publicly documented, but the structured intelligence did not flag POC=YES or KEV=YES, so active exploitation is NOT confirmed. The design defects are clear from the description (verbatim append of TranscoderH264Options into x264 options; unsigned/unchecked .so loading at startup), making the vulnerability technically credible and reliably weaponizable by anyone holding admin. Net: real priority for anyone exposing the Plex admin interface to untrusted networks or reusing admin credentials, but the admin prerequisite keeps it below the tier of wormable pre-auth RCE.

An attacker who has gained Plex admin access - via credential reuse, a phished/hijacked admin session, or an exposed default-owner account - plants a malicious shared object or sets the TranscoderH264Options preference so attacker-controlled content is fed verbatim into x264 on the next transcode. On server startup or the next transcode the unsigned .so is loaded (no signature, execute-bit, or symbol checks), yielding code execution as the Plex server process. A public technical writeup ('plex2shell') appears to document the technique, though no formal POC/KEV flag was present in the source data.