---
id: "CVE-2026-114197"
kind: "vulnerability"
aliases: ["CVE-2026-114197"]
title: "capa: crafted workspace file runs code during deserialization"
severity: "high"
cvss: 8.7
epss: 0.00116
exploited: false
status: "open"
category: "package"
products: [{"name": "capa", "fixed": ["10.0.0"], "affected": "< 10.0.0", "ecosystem": "pip"}]
ecosystems: ["pip"]
tags: ["capa", "deserialization", "malware-analysis", "package", "pickle", "reverse-engineering"]
not_affected_if: ["capa-10.0.0-or-later", "only-analyzes-own-samples"]
published_at: "2026-10-21T01:17:38+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114197", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:49:38+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114197", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# capa: crafted workspace file runs code during deserialization

capa before 10.0.0 automatically loads a cached Vivisect workspace (.viv, e.g. sample.exe.viv) found next to the sample you analyze. Vivisect workspaces are Python pickle, so a crafted one runs code as the user running capa. A crafted file named *.viv passed directly to capa can also trigger it. The attacker has to get you to analyze a sample or a directory they control. Reported by Waleed Ali; fixed Oct 15, advisory Oct 20.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pip:capa affected < 10.0.0 fixed 10.0.0

## How to check

Run 'capa --version' or 'pip show flare-capa'; anything below 10.0.0 is affected (standalone binary: same version check). Also look for stray *.viv files next to samples you analyze, and treat any you did not create as hostile.

## Fix

Upgrade to capa 10.0.0 or later (pip install -U flare-capa, or the standalone release binary). From 10.0.0, capa always parses samples as PE or ELF and only loads an existing .viv when CAPA_LOAD_VIV_WORKSPACE=1 is set; enable that only for .viv files you trust. Until upgraded, run capa on untrusted samples in a clean directory or a sandbox VM, with no .viv files present.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114197
- 2026-10-23T23:49:38+00:00 analyst — Read Mandiant advisory MNDT-2026-0035 and capa v10.0.0 release notes. No PoC or exploitation found, no X chatter (count 0). Release notes say affected v9.4.0 and earlier.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114197

## Documents

- [advisory] MNDT-2026-0035: capa deserialization of untrusted .viv workspace https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0035.md
- [fix] capa v10.0.0 release notes (Security section) https://github.com/mandiant/capa/releases

## From the sources

Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_