Plex Media Server versions earlier than 1.43.3.10861 allow an administrator to write arbitrary files to the system that may be executed during startup or transcoding. The vulnerability exploits the TranscoderH264Options preference, which is appended verbatim to the x264 option string on every transcode. Because startup loads all shared object files without performing signature, execute‑bit, or symbol checks, a crafted file can be executed with elevated privileges. This flaw aligns with CWE‑73 and can result in full code execution authority for the attacker.

The affected product is Plex Media Server, specifically any instance running a version older than 1.43.3.10861. The flaw is present across all operating systems supported by that product version, including Windows, macOS, and Linux distributions.

The CVSS score of 8.6 classifies the issue as high severity, while the EPSS score is currently unavailable, indicating that the probability of exploitation is not quantified but should not be ignored. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented public exploits as of now. Attackers would need administrator access to the Plex Media Server web interface or API to alter the TranscoderH264Options preference, making it a local‑admin or privilege escalation vector rather than a remote code‑execution attack that can be triggered by an unauthenticated user.