CVE-2026-86930

CriticalCVSS 9.1/10Last modified Oct 5, 2026

Description

An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebDirect. This vulnerability is addressed in FileMaker Server version 26.0.3.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Oct 5, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-869325.5An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to acce CVE-2026-869333.3A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27. An app may be able to a CVE-2026-869349.1An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header CVE-2026-86935This issue was addressed by removing additional entitlements. This issue is fixed in macOS Golden Gate 27. An app may be able to access user CVE-2026-869387.3A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated admini CVE-2026-86945.3Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the Ope CVE-2026-869405.5This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27. An app may be able to disclose kernel CVE-2026-86944An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.CVE-2026-86948This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to br CVE-2026-869498.8This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be a CVE-2026-86959.8radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that allows remote attackers to trigger memory cor CVE-2026-869508.8An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia