CVE-2026-86930 is a critical (CVSS 9.1) out-of-bounds read in Claris FileMaker Server for Linux. A specially crafted image file uploaded to a container field can disclose process memory during thumbnail generation in FileMaker WebDirect. Claris says version 26.0.3 addresses it, so update.
What's affected
The record names FileMaker Server for Linux and says the issue is addressed in FileMaker Server 26.0.3. The exposure is the WebDirect thumbnail path: an attacker uploads a crafted image to a container field.
The record does not list the earlier versions that are affected, and the Claris advisory page could not be loaded when this guide was written. Read the advisory to see which releases are in range for your deployment.
How to check if you're exposed
Open the FileMaker Server Admin Console and read the version on the main page. Anything below 26.0.3 on Linux should be treated as affected until the advisory says otherwise.
Then decide how WebDirect is used. If WebDirect is enabled and users, or external parties, can place files into container fields, the exposure is real. If WebDirect is off and no file upload path exists, the practical risk is lower, though you should still update.
What to do now
- Update FileMaker Server for Linux to 26.0.3 or later.
- If you cannot update at once, limit who can reach WebDirect, for example with a network allowlist or a VPN.
- Review which accounts can write to container fields and remove access that is not needed.
- Read the Claris advisory for any extra steps or workarounds.
Why it matters
The weakness is CWE-125 (out-of-bounds read). Image decoding is a classic source of memory bugs, because file formats are complex and the parser trusts values inside the file. Here, a malformed image made the thumbnail code read memory it should not have, and the result could be returned to the requester.
Memory disclosure can reveal session data, keys or other content held by the server process. The vector in the record shows network access with no privileges and no user interaction, which explains the high score.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Quick check
What is the fixed version?
FileMaker Server 26.0.3, according to the record. Confirm in the Claris advisory.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Listed in the record but not readable when this guide was written, so confirm details there:
Last reviewed: 19 October 2026.
