Plex Media Server and Desktop security update #
Plex has issued a security update addressing multiple undisclosed vulnerabilities across Plex Media Server and Plex Desktop. While formal CVE identifiers have been requested, specific technical details and CVSS ratings remain undisclosed (note, this is a bad idea). Unpatched installations may expose systems to unauthorized access or remote security risks depending on the specific attack vector.
The following versions are affected
- Plex Media Server: Versions prior to 1.43.3
- Plex Desktop: Versions prior to 1.115.0
What are Plex Media Server and Plex Desktop? #
Plex Media Server and Plex Desktop form a client-server media system where the server organizes and streams personal media files from a central storage device, and the desktop application serves as a frontend interface for browsing and playing that content on a computer.
What is the impact? #
Successful exploitation of these vulnerabilities would allow an attacker to compromise the security posture of the host system, potentially resulting in unauthorized access or system disruption depending on the specific unreleased flaws and exposure.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- Plex Media Server: Upgrade to version 1.43.3 or later.
- Plex Desktop: Upgrade to version 1.115.0 or later.
Note for Network-Attached Storage (NAS) deployments: Automated package managers on NAS platforms may experience distribution delays. If the patched build is not available via the vendor repository, manually download and apply the package from the official Plex Downloads page.
Finding exposed Plex Media Server and Desktop with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:=Plex AND product:"Media Server"August 2025: CVE-2025-34158 #
Plex released a security update for a previously undisclosed vulnerability that stemmed from an incorrect resource transfer between spheres in certain versions of Plex Media Server. The flaw had been reported to Plex through its bug bounty program, and further details were not yet public at the time. This vulnerability was designated CVE-2025-34158 and was rated high with a CVSS score of 8.5.
The following versions were affected:
- Plex Media Server versions 1.41.7.x through 1.42.0.x
The impact of the vulnerability was initially unknown. However, Plex "strongly recommended" that users update to the latest version as quickly as possible.
Users were encouraged to update to the latest version as quickly as possible:
- Plex Media Server upgraded to version 1.42.1 or later
From the Software Inventory, users could use the following query to locate potentially impacted assets:
vendor:=Plex AND product:"Media Server" AND (version:>0 AND version:<"1.42.1")
