CVE-2026-86938 in FileMaker Pro
Summary
by MITRE • 09/23/2026
A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated administrator privileges by placing a malicious DLL file in the installer directory. This vulnerability is addressed in FileMaker Pro version 26.0.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The identified security flaw represents a classic instance of insecure dynamic link library search order behavior, commonly referred to as DLL hijacking or DLL preloading. In this specific scenario affecting the FileMaker Pro installer for Windows, the vulnerability arises from the application's failure to specify absolute paths when loading required dynamic-link libraries during its installation process. Instead of referencing libraries by their full system path, the installer relies on the default search order defined by the operating system. This architectural oversight creates a critical security gap that can be exploited by any local user with write access to the directory where the installer resides or executes.
When an attacker places a maliciously crafted DLL file in the same directory as the FileMaker Pro installer, the Windows loader will prioritize this locally placed library over legitimate system libraries due to the search order rules. Specifically, the current working directory is typically searched before system directories such as System32. Consequently, when the installation process initiates and attempts to load a specific DLL that exists in both locations or relies on relative path resolution, it inadvertently loads the attacker-controlled malicious version. This mechanism allows for arbitrary code execution within the context of the installer process.
The operational impact of this vulnerability is severe due to the privilege level at which the FileMaker Pro installer operates. Installers typically require elevated administrator privileges to write files to protected system directories, modify registry keys, and configure services. By exploiting the DLL hijacking flaw, a local user can trick the privileged installation process into executing their malicious code with these same high-level permissions. This effectively results in privilege escalation from a standard low-privileged account to full administrative control over the affected Windows host. The attacker gains the ability to install persistent backdoors, create new administrator accounts, disable security software, or exfiltrate sensitive data stored on the machine.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-427, which describes Uncontrolled Search Path Element. From a tactical perspective, this exploitation technique corresponds to MITRE ATT&CK tactic T1574.007, specifically the DLL search hijacking sub-technique under Process Injection and Defense Evasion. The attack vector is classified as Local (L), requiring physical or logical access to the machine prior to execution, but it does not require user interaction beyond placing the malicious file in the target directory if the installer is subsequently run by any user with sufficient permissions to trigger the installation routine.
Mitigation for this vulnerability involves upgrading FileMaker Pro to version 26.0.3 or later, where the vendor has implemented fixes to ensure that DLLs are loaded from trusted, absolute paths rather than relying on relative search orders. In environments where immediate patching is not feasible, administrators should enforce strict file integrity monitoring on directories containing installers and application binaries. Additionally, implementing Application Control policies such as Microsoft AppLocker or Windows Defender Application Control can prevent the execution of unsigned or unauthorized DLLs from user-writable locations. Regular audits of installer packages to ensure they do not rely on insecure loading mechanisms are also recommended for development teams deploying software in shared or multi-user environments.