CVE-2026-86930

Critical · CVSS 9.1

CVSS: 9.1; nvd
EPSS: —
KEV: No
Class: other; CWE-125

Description

An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebDirect. This vulnerability is addressed in FileMaker Server version 26.0.3.

References

https://support.claris.com/s/answerview?anum=000049218&language=en_US

Status: profiled · ingested 2026-10-06T00:00:53.000Z