FileMaker Pro EUVD-2026-85430

Exploitation requires local access to a Windows host as a low-privileged user who can write a malicious DLL into the directory used by the FileMaker Pro installer (versions before 26.0.3), and it only triggers when a privileged user (administrator) subsequently runs that installer from the attacker-influenced location - the elevation to administrator comes from the installer's own privileged context. Limiting factors: it is local-only (AV:L), needs the specific act of an admin executing the vulnerable installer (UI:R), depends on the insecure DLL search path in the installer, and affects only the Windows installer, not the installed application at runtime. It is not remotely reachable and not automatable per SSVC.

This is a local privilege-escalation issue with realistic but constrained risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 7.3) requires local access and user interaction: a low-privileged local user plants a malicious DLL, but code only runs when the FileMaker Pro installer is executed by an administrator (UI:R plus the elevation described). SSVC reinforces this profile - Exploitation: none, Automatable: no (it depends on a human running the installer), Technical Impact: total. Exploitation signals are quiet and consistent: EPSS is 0.15% (3rd percentile), there is no CISA KEV listing and no public exploit identified at time of analysis. There is no signal conflict here - every source points to a genuine but non-urgent, non-wormable local EoP. Note one metadata inconsistency to verify: the assigned CWE-639 (Authorization Bypass Through User-Controlled Key) does not match the described DLL hijacking, which is CWE-427 (Uncontrolled Search Path Element); this does not change the risk but signals classification error. Priority should be moderate - patch during normal cycles, prioritizing multi-user Windows workstations where untrusted local users could stage a DLL before an admin-run install.

On a shared Windows workstation, a low-privileged local user drops a malicious DLL into the directory from which the FileMaker Pro installer is run, anticipating the installer's insecure DLL search order. When an administrator later launches the installer, the planted DLL is loaded and its code executes with elevated administrator privileges, giving the attacker full local compromise. No public exploit code has been identified, and the attack requires the administrator to run the installer from the attacker-influenced directory.