FileMaker Server CVE-2026-86930

Requires a FileMaker Server for Linux instance running FileMaker WebDirect, hosting a solution that exposes a container field the attacker can upload into; the attacker must submit a crafted image so that server-side thumbnail generation over-reads memory. Limiting factors: WebDirect must be enabled and the container-upload path reachable (which generally implies a WebDirect guest or authenticated session, so exploitation is not purely anonymous in most deployments), and only the Linux server variant is affected. Impact is bounded to memory disclosure (and possible process crash), not code execution.

This is a genuine but not urgent priority. The NVD CVSS 3.1 vector (9.1, AV:N/AC:L/PR:N/UI:N/C:H/A:H) paints a critical remote-unauthenticated picture, but multiple independent signals temper that: EPSS is only 0.14% (3rd percentile), there is no CISA KEV listing, and no public POC has been identified. SSVC aligns with 'Exploitation: none' (no observed activity) while flagging 'Automatable: yes' and 'Technical Impact: total' - meaning that IF a reliable exploit emerged it could be scripted broadly, which is the main reason to patch promptly despite low current EPSS. Two vector points warrant scrutiny: PR:N is questionable because uploading an image to a container field via WebDirect normally implies a WebDirect session (guest or account) to a solution that exposes an editable container field - verify whether the target deployment permits anonymous uploads. A:H is also generous: an out-of-bounds READ during thumbnail generation typically yields memory disclosure (C:H, justified) and at most a process crash (A:L), not a total availability loss - verify with vendor. Net: patch on a normal cycle, not emergency, given no exploitation evidence.

An attacker with access to a FileMaker WebDirect solution that exposes a container field uploads a specially crafted image file. During server-side thumbnail generation the malformed image triggers an out-of-bounds read, and fragments of FileMaker Server process memory (potentially including session tokens or other users' data) are disclosed back to the attacker. No public exploit code has been identified at time of analysis.