Live › vulnerability › CVE-2026-114197
Go to dashboardcapa before 10.0.0 automatically loads a cached Vivisect workspace (.viv, e.g. sample.exe.viv) found next to the sample you analyze. Vivisect workspaces are Python pickle, so a crafted one runs code as the user running capa. A crafted file named *.viv passed directly to capa can also trigger it. The attacker has to get you to analyze a sample or a directory they control. Reported by Waleed Ali; fixed Oct 15, advisory Oct 20.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| capa | pip | < 10.0.0 | 10.0.0 |
capa --version or pip show flare-capa; anything below 10.0.0 is affected (standalone binary: same version check)10.0.0 or later (pip install -U flare-capa, or the standalone release binary)10.0.0, capa always parses samples as PE or ELF and only loads an existing .viv when CAPA_LOAD_VIV_WORKSPACE=1 is set; enable that only for .viv files you trustEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility
This page as .md · .json · in your agent: get_signal("CVE-2026-114197")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.