A critical out-of-bounds read vulnerability in Claris FileMaker Server for Linux poses a severe risk of information disclosure and potential denial of service.

This is an out-of-bounds read vulnerability triggered during thumbnail generation in FileMaker WebDirect. An unauthenticated attacker can exploit this by uploading a specially crafted image file to a container field, leading to the disclosure of process memory.

Successful exploitation allows an unauthenticated attacker to read sensitive process memory, which may contain credentials, session tokens, or other confidential information. Given the CVSS score of 9.1, this represents a critical risk to data confidentiality and system integrity. Failure to remediate could result in significant data breaches and unauthorized access to internal FileMaker database environments.

Immediate Action: Update Claris FileMaker Server to version 26.0.3 or later immediately to resolve the underlying out-of-bounds read flaw.

Proactive Monitoring: Review web server and FileMaker application logs for unusual image upload patterns or repeated attempts to trigger thumbnail generation processes.

Compensating Controls: Implement strict input validation or file type restrictions on container fields via a Web Application Firewall (WAF) to block malicious or malformed image files from reaching the server.

Public Exploit Available: Unknown

This vulnerability presents a critical threat due to its unauthenticated attack vector and the potential for memory disclosure. Security teams should prioritize the update of all FileMaker Server instances to version 26.0.3. If immediate patching is not feasible, restrict access to the WebDirect interface to trusted networks until the update can be applied.