Plex Media Server versions earlier than 1.43.3.10861 allow an administrator to write arbitrary files to the system that may be executed during startup or transcoding. The vulnerability exploits the TranscoderH264Options preference, which is appended verbatim to the x264 option string on every transcode. Because startup loads all shared object files without performing signature, execute‑bit, or symbol checks, a crafted file can be executed with elevated privileges. This flaw aligns with CWE‑73 and can result in full code execution authority for the attacker.

The affected product is Plex Media Server, specifically any instance running a version older than 1.43.3.10861. The flaw is present across all operating systems supported by that product version, including Windows, macOS, and Linux distributions.

The CVSS score of 8.6 classifies the issue as high severity. The EPSS score of 0.00816 indicates a very low but non‑zero probability of exploitation, suggesting that while the risk is high if exploited, the likelihood of exploitation is currently low. The vulnerability is listed in the CISA KEV catalog, indicating that documented public exploits exist or that the vulnerability is of high concern. Attackers would need administrator access to the Plex Media Server web interface or API to alter the TranscoderH264Options preference, making it a local‑admin or privilege escalation vector rather than a remote code‑execution attack that can be triggered by an unauthenticated user.