An out‑of‑bounds read flaw (CWE-125) in FileMaker Server for Linux lets an attacker upload a crafted image file to a container field, causing the server to read beyond the intended buffer during thumbnail generation in FileMaker WebDirect and expose sections of process memory. No additional privileges or code execution are required by the reported configuration.

All Claris FileMaker Server for Linux installations running a version prior to 26.0.3 are affected, as the vulnerability is tied to the thumbnail generation routine used when images are uploaded via the WebDirect interface.

The CVSS score of 9.1 indicates a high severity for confidentiality, while the EPSS score is less than 1%, reflecting a low but non‑zero likelihood of exploitation today. The vulnerability is not listed in the CISA KEV catalog, and no widespread exploitation has been reported. The attack vector is likely through the WebDirect image upload pathway, and the flaw limited to exposing process memory without granting code execution or additional system control.