CVE-2026-86926: FileMaker Server Buffer Overflow Vulnerability

CVE-2026-86926 Overview

CVE-2026-86926 is a heap buffer overflow vulnerability in the FileMaker Server database engine. The flaw resides in the block parsing routine that processes .fmp12 database files. A maliciously crafted database file triggers memory corruption on the heap during parsing. Successful exploitation can lead to arbitrary code execution within the context of the FileMaker Server process. Claris addressed the issue in FileMaker Server version 26.0.3. See the Claris Support Article for vendor guidance.

Critical Impact
A crafted .fmp12 file processed by FileMaker Server can corrupt heap memory and enable arbitrary code execution on the database host.

Affected Products

FileMaker Server versions prior to 26.0.3
Claris FileMaker Server database engine block parser
Deployments that host or import .fmp12 database files

Discovery Timeline

2026-09-23 - CVE-2026-86926 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-86926

Vulnerability Analysis

The vulnerability is a heap buffer overflow [CWE-122] in the FileMaker Server database engine. The engine parses .fmp12 database files as a sequence of structured blocks. Each block carries length and type metadata that the parser uses to allocate and populate heap buffers. When the parser processes a crafted block, it writes past the bounds of an allocated heap region. This out-of-bounds write corrupts adjacent heap metadata and application objects. Attackers who control the corrupted data can influence execution flow and achieve arbitrary code execution in the server process.

Root Cause

The root cause is inadequate validation of block size or field length values within the .fmp12 parsing routine. The parser trusts attacker-controlled length fields when copying block payload into a heap buffer. A mismatch between the declared and actual buffer sizes produces the overflow. Version 26.0.3 corrects the boundary handling in the affected routine.

Attack Vector

Exploitation requires FileMaker Server to process a malicious .fmp12 database file. An attacker delivers the crafted file through hosting, upload, restore, or import workflows exposed by the server. No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication. Refer to the Claris Support Article for the technical scope.

No verified exploit code is available. The vulnerability mechanism is described in prose per vendor guidance.

Detection Methods for CVE-2026-86926

Indicators of Compromise

Unexpected crashes or restarts of the FileMaker Server database engine process during file open or import operations.
Presence of unknown or externally sourced .fmp12 files in hosting or import directories.
Anomalous child processes or shell activity spawned by the FileMaker Server service account.

Detection Strategies

Monitor FileMaker Server logs for parser errors, abnormal termination, or repeated failed database open events.
Alert on file writes of .fmp12 files to server-hosted database directories from non-administrative accounts.
Correlate FileMaker Server process crashes with subsequent outbound network connections or new process creation.

Monitoring Recommendations

Enable verbose logging on FileMaker Server and forward events to a centralized log platform for retention and analysis.
Track file integrity for hosted database directories and flag additions or replacements of .fmp12 files.
Baseline normal FileMaker Server process behavior and alert on deviations such as unexpected memory usage spikes or child processes.

How to Mitigate CVE-2026-86926

Immediate Actions Required

Upgrade FileMaker Server to version 26.0.3 or later on all affected hosts.
Restrict upload, hosting, and import of .fmp12 files to trusted administrators until patching completes.
Inventory all FileMaker Server instances, including test and development systems, to confirm patch coverage.

Patch Information

Claris released FileMaker Server version 26.0.3 to address this vulnerability. Administrators should download the update from Claris and apply it following the vendor upgrade procedure. Full remediation details are documented in the Claris Support Article.

Workarounds

Block untrusted .fmp12 file uploads at the network perimeter or application layer until the patch is deployed.
Run FileMaker Server under a least-privilege service account to limit the blast radius of code execution.
Isolate FileMaker Server hosts on a segmented network and restrict inbound access to authenticated clients only.

bash

# Verify installed FileMaker Server version on Linux
fmsadmin -v

# Verify installed FileMaker Server version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\FileMaker\FileMaker Server\26.0" | Select-Object Version