A heap buffer overflow in FileMaker Server’s database engine block parsing routine can corrupt memory and potentially allow arbitrary code execution. This flaw arises when the server processes a maliciously crafted .fmp12 database file, leading to a critical compromise of the server’s integrity.

All versions of Claris FileMaker Server before 26.0.3 are affected, including all prior releases; later releases contain the fix.

The vulnerability is triggered by the delivery of a malformed .fmp12 file to the server; the CVSS score of 7.8 indicates high severity, the EPSS score is <1%, and it is not listed in CISA’s KEV catalog; thus, an exact exploitation probability cannot be calculated from the data. Given the potential for arbitrary code execution, the risk level is severe, but current evidence does not provide a quantitative assessment of how often this flaw is likely to be successfully exploited in the wild.