CVE-2023-42920 is a high severity (CVSS 7.8) dylib hijacking flaw in the FileMaker Pro and Claris Pro apps on macOS. Claris says it fixed the issue. The record does not give a fixed version number, so read the Claris security information page and update both apps to the release it names.
What's affected
The record lists Claris Pro, FileMaker Pro and macOS in its product data, and its description says Claris International fixed a dylib hijacking vulnerability in the FileMaker Pro.app and Claris Pro.app versions on macOS.
The record gives no affected version range and no fixed version. The one reference is the Claris FileMaker Security Information page. When I fetched it, the page returned only a loading shell, so I could not confirm version numbers. Do not guess them. Open the page in a browser and match the entry for this CVE.
The weakness is CWE-427, an untrusted search path. The vector needs a local, low privilege account and no user interaction.
How to check if you're exposed
On a Mac, read the installed version of each app and compare it with the version the Claris page lists as fixed:
mdls -name kMDItemVersion "/Applications/FileMaker Pro.app"
mdls -name kMDItemVersion "/Applications/Claris Pro.app"
If an app is not installed, the command reports that the file cannot be found, which is fine. Also check the Applications folder of each user, since some people keep their own copy.
What to do now
- Open the Claris FileMaker Security Information page and find the entry for CVE-2023-42920.
- Update FileMaker Pro and Claris Pro to the release the page names, or a later one.
- Find every Mac that has either app, including copies in user folders, using your management tool.
- Keep application folders writable only by administrators so a planted library cannot be dropped next to the app.
- Record the fixed version in your tracker once you have confirmed it.
Why it matters
Dylib hijacking is a macOS issue where an app loads a dynamic library from a place a lower privileged user can write to, or looks for a library in an order an attacker can influence. If a hostile library is loaded, its code runs with the app's rights and permissions. The record's class, CWE-427, covers loading code from a search path that is not trusted.
This is a local attack, with a low privilege account and no interaction. The impact in the vector is high across the board. The KEV flag is false and nothing in the record claims exploitation. The right response is the vendor update plus tight permissions on the install location.
Quick check
What version fixes CVE-2023-42920?
The record does not say, and the Claris page did not load its content when I fetched it. Check the Claris security information page directly.
Sources
- Claris: FileMaker Security Information (referenced in the record; content did not load when fetched)
Last reviewed: 19 October 2026.
