Live › vulnerability › CVE-2026-114198
Go to dashboardFLOSS releases before 3.2.0 deserialize untrusted data from workspace files. An attacker who gets a crafted .viv or .exe.viv file to someone running floss can execute arbitrary code on that machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed floss version; anything before 3.2.0 is affected. unknown for any other check.
3.2.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility
This page as .md · .json · in your agent: get_signal("CVE-2026-114198")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.