CVE-2026-86926

HighCVSS 7.8/10Last modified Oct 6, 2026

Description

A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously crafted .fmp12 database file to cause memory corruption, potentially leading to arbitrary code execution. This vulnerability is addressed in FileMaker Server version 26.0.3.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

VendorProductVersions
ClarisFileMaker Server< 26.0.3

References

Timeline

Published
Sep 23, 2026
Last modified
Oct 6, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-869285.5A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27. An app may be able to access protCVE-2026-869298.8An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2,CVE-2026-869309.1An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a containeCVE-2026-869316.2A privacy issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS TahoCVE-2026-869325.5An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to acceCVE-2026-869333.3A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27. An app may be able to aCVE-2026-869349.1An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege headerCVE-2026-869355.5This issue was addressed by removing additional entitlements. This issue is fixed in macOS Golden Gate 27. An app may be able to access userCVE-2026-869367.8A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. ACVE-2026-869375.5A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS TahoeCVE-2026-869387.3A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated adminiCVE-2026-869394.9A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An attack
CVE-2026-86926: High severity, CVSS 7.8 | Vulnix