EUVD-2026-85429
GHSA-9vrp-wjh8-mfg5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious .fmp12 database file
-
DeliveryDeliver to server operator
-
ExploitOperator opens/hosts file
-
ExecutionTrigger heap overflow in block parser
-
PersistCorrupt heap memory
-
ImpactExecute code as server process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the FileMaker Server to parse an attacker-controlled .fmp12 database file via its database engine block-parsing routine, and requires user interaction (UI:R) - an operator must open or host the crafted database. The vector is local (AV:L), so the malicious file must be delivered to and processed on the server rather than triggered over the network. No authentication is required (PR:N), but the reliance on victim interaction and local file delivery is the primary limiting factor; affected deployments are FileMaker Server versions prior to 26.0.3. |
| Impact | This is a moderate-priority, genuine memory-corruption flaw that is not currently an urgent field threat. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U) scores 7.8 (High) and is internally consistent with the description: exploitation is local and file-driven, requiring a victim to open or host a maliciously crafted .fmp12 database rather than a remote network trigger. The technical impact is total (C:H/I:H/A:H, CWE-122 heap overflow potentially leading to arbitrary code execution), which SSVC corroborates with Technical Impact = 'total'. However, the exploitation signals all point downward: SSVC Exploitation = 'none' and Automatable = 'no', EPSS is only 0.16% (4th percentile), there is no CISA KEV listing and no public POC. The low EPSS and 'not automatable' rating are consistent with the local, user-interaction-gated vector - this is a targeted, socially-engineered file-delivery vulnerability rather than a wormable remote bug. Net: patch it on a normal cadence (it can yield code execution as the FileMaker Server process), but there is no evidence of active or imminent mass exploitation. |
| Exploit ScenarioDerived | An attacker crafts a malicious .fmp12 database file and delivers it to a FileMaker Server operator (e.g., via email or a shared repository), who then hosts or opens it on the server. The database engine's block-parsing routine overflows a heap buffer while parsing the crafted structures, corrupting memory and potentially executing attacker code in the context of the server process. No public exploit code has been identified at time of analysis, and the local vector plus required user interaction make this a targeted rather than opportunistic attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Heap-based memory corruption in Claris FileMaker Server's database engine block-parsing routine allows a maliciously crafted .fmp12 database file to overflow a heap buffer, potentially enabling arbitrary code execution in the context of the FileMaker Server process. All FileMaker Server releases prior to 26.0.3 are affected; exploitation requires that the crafted database be delivered to and processed by the server and that an operator open or host it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), so the local delivery path and required user interaction are the principal limiting factors rather than any authentication barrier, since no privileges are needed (PR:N). No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and EPSS is low at 0.16% (4th percentile), making this a moderate-priority memory-corruption fix rather than an urgent field threat; Claris has released a vendor patch in FileMaker Server 26.0.3.
RemediationAI
Upgrade FileMaker Server to version 26.0.3 or later, the vendor-released fix that addresses the block-parsing overflow, following the Claris advisory at https://support.claris.com/s/answerview?anum=000049219&language=en_US and confirming the patch level against the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-86926. Until the upgrade is applied, reduce exposure by treating .fmp12 files as untrusted input: scan and vet any database file before it is copied onto the server or added to the hosted databases directory, and restrict write access to that directory to a small set of trusted administrators, accepting that this is a process control whose effectiveness depends on consistent enforcement and is no substitute for the patch. Because the parsing path does not require authentication but does require a user to open or host the file (UI:R) and local file delivery (AV:L), the practical hardening is to limit interactive logon and file-upload rights on the server host, run the FileMaker Server service under a least-privilege account rather than root or SYSTEM to constrain post-exploitation impact, and, where feasible, isolate the server so that a compromised service account cannot reach broader network resources. Each of these controls carries trade-offs: stricter upload vetting slows legitimate database provisioning, and least-privilege service accounts can break custom plug-ins or external data source integrations, so validate the configuration in a test environment before rolling it out; no public exploit code was identified at time of analysis, which lowers but does not eliminate the urgency of patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic heap-based buffer overflow (CWE-122) in the routine that parses database engine blocks inside FileMaker's .fmp12 container format. FileMaker Server must read and interpret structural block records from the database file during hosting or import operations; if the parser trusts length or count fields in those blocks without validating them against the size of the allocated heap chunk, an attacker-crafted file can write past the buffer boundary and corrupt adjacent heap metadata or objects, which is the usual route from memory corruption to control-flow hijack and code execution. The affected component is identified by CPE cpe:2.3:a:claris:filemaker_server with an unconstrained version wildcard; the European vulnerability database entry (EUVD-2026-85429) narrows the vulnerable range to FileMaker Server versions from 0 up to, but not including, 26.0.3. The CVSS vector AV:L/UI:R/PR:N indicates the attacker does not need network reachability or credentials but does need the malicious .fmp12 file to reach the server and a user to open or host it, and SSVC rates technical impact as total while judging the flaw non-automatable given that interaction requirement.
Know when Filemaker Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-parse (AV:L) needing a victim to open/host a crafted .fmp12 (UI:R) with no privileges (PR:N); heap overflow yields code execution, so C:H/I:H/A:H, unchanged scope.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously crafted .fmp12 database file to cause memory corruption, potentially leading to arbitrary code execution. This vulnerability is addressed in FileMaker Server version 26.0.3.
Executive ViewAI
Claris FileMaker Server deployments running versions earlier than 26.0.3 are exposed to a heap memory-corruption flaw that a maliciously crafted .fmp12 database file could use to execute code with the privileges of the FileMaker Server process - a service that typically holds sensitive business and customer data. The attack path is not remote or automated: no privileges are needed (unauthenticated), but an operator must open or host the crafted file on the server, and no public exploit code or active exploitation has been identified at time of analysis. With a vendor fix already available and EPSS at roughly the 4th percentile, this is a scheduled patching priority for database and server administration teams rather than an emergency response.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Filemaker Server
View allAn XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote atta
FileMaker Server deployments that expose the Web Publishing Engine can be driven into serving the XML Web Publishing int
Server-side thumbnail generation in FileMaker Server for Linux can be forced to over-read process memory when an attacke
Claris International has resolved an issue of potentially allowing unauthorized access to records stored in databases ho
A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access an
Claris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to a
Arbitrary code execution on the host operating system is achievable by an authenticated FileMaker Server administrator v
Exploit-DB