CVE-2026-96656 in Plex Media Server lets an admin write and execute arbitrary code

Plex Media Server below 1.43.3.10861 is affected by CVE-2026-96656 (CVSS 7.2/8.6): the TranscoderH264Options preference is appended verbatim to the x264 command line, and the server loads every .so from plugin folders without signature or symbol checks. An admin can write a library via the encoder and have it executed on restart.

• CVSS v3.1 7.2, v4.0 8.6, CWE-73, admin privileges required
• TranscoderH264Options reaches the x264 command line unvalidated
• Server loads .so files from plugin locations without integrity checks
• Versions below 1.43.3.10861 affected; ZoomEye found 507,974 instances