CVE-2026-114197: Deserialization of untrusted data in capa
Published Oct 21, 2026
·Updated
Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility
Affected Software
1 affected component
Mandiant capa<10.0.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mandiant FLARE capato a version that resolves this vulnerability.Fixed in 10.0.0
Event History
Oct 21, 2026
CVE Published
via MITRE·12:39 AM
Data Sourced
via MITRE·12:39 AM
DescriptionWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Users of Mandiant FLARE capa releases before 10.0.0 are exposed if they pass an attacker-crafted .viv or .exe.viv workspace to the capa utility.
2
What must an attacker provide to exploit the vulnerability?
The attacker needs to get a crafted .viv or .exe.viv workspace processed by the capa utility. Successful exploitation can result in arbitrary code execution.
3
What version addresses the issue?
The issue affects releases before 10.0.0. Use capa 10.0.0 or later.