{"id":"CVE-2026-114198","kind":"vulnerability","aliases":["CVE-2026-114198"],"related":[],"title":"FLARE floss: crafted workspace file runs code on analyst's machine","description":"Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility","summary":"FLOSS releases before 3.2.0 deserialize untrusted data from workspace files. An attacker who gets a crafted .viv or .exe.viv file to someone running floss can execute arbitrary code on that machine.","severity":"high","cvss":8.7,"epss":0.00116,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["floss","malware-analysis","package","python","reverse-engineering"],"not_affected_if":["floss-3.2.0-or-later","no-untrusted-viv-files"],"how_to_check":"Check the installed floss version; anything before 3.2.0 is affected. unknown for any other check.","fix":"Upgrade floss to 3.2.0 or later. Do not pass untrusted .viv or .exe.viv workspaces to floss until upgraded.","status":"open","published_at":"2026-10-21T01:17:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:37:00+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:37:00Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade floss to 3.2.0 or later. Do not pass untrusted .viv or .exe.viv workspaces to floss until upgraded.","reach":"local","title":"FLARE floss: crafted workspace file runs code on analyst's machine","impact":"high","summary":"FLOSS releases before 3.2.0 deserialize untrusted data from workspace files. An attacker who gets a crafted .viv or .exe.viv file to someone running floss can execute arbitrary code on that machine.","category":"package","who_cares":["floss","reverse-engineering","malware-analysis","python"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code as the user who ran floss","analyst_note":"","how_to_check":"Check the installed floss version; anything before 3.2.0 is affected. unknown for any other check.","needs_analyst":false,"not_affected_if":["floss-3.2.0-or-later","no-untrusted-viv-files"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.0009,"input_tokens":2888,"output_tokens":1222,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114198':14A,17A '-2026':13A,16A '3.2.0':30B,68C 'allow':69C 'analysi':21B 'analyst':9A 'arbitrari':53B,70C 'attack':38B 'code':7A,54B,71C 'craft':3A,42B,75C 'cve':12A,15A 'data':33B,61C 'deseri':31B,58C 'engin':26B 'exe.viv':45B,78C 'execut':52B,72C 'file':5A,36B,46B 'flare':1A,64C 'floss':2A,18B,27B,50B,65C,84C 'get':40B 'machin':11A,57B 'malwar':20B 'malware-analysi':19B 'mandiant':63C 'packag':22B 'pass':81C 'python':23B 'releas':28B,66C 'revers':25B 'reverse-engin':24B 'run':6A,49B 'someon':48B 'untrust':32B,60C 'util':85C 'viv':43B,76C 'workspac':4A,35B,79C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"mandiant-cve@google.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114198","severity":null,"published_at":"2026-10-21T01:17:38+00:00","modified_at":"2026-10-22T17:36:46+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114198","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114198","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}