A DLL hijacking flaw in the Windows installer for Claris FileMaker Pro permits a local user to place a malicious DLL in the installer directory and force the updater to load it, resulting in arbitrary code execution with elevated administrator privileges. The weakness is classified as a process control flaw (CWE-639). The impact is the compromise of system integrity and confidentiality and the ability to gain full control of the affected workstation.

Claris FileMaker Pro on Windows, installer path. The vulnerability is present in versions prior to 26.0.3; 26.0.3 and later contain the fix.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, but the local attack surface is high because any authenticated user with write access to the installer directory can exploit the flaw. The CVSS score of 7.3 indicates a high severity and signals significant potential impact if exploited. Because the exploit yields administrator privileges, the potential damage is severe, and the likelihood of exploitation is high in environments where installers are dropped to local user folders.