CVE-2026-114198: Deserialization of untrusted data in floss
Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mandiant FLARE flossto a version that resolves this vulnerability.Fixed in 3.2.0
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users of Mandiant FLARE floss versions before 3.2.0 are exposed when they pass an attacker-crafted .viv or .exe.viv workspace to the floss utility.
What must an attacker provide to trigger the issue?
The attacker needs to cause a crafted .viv or .exe.viv workspace to be passed to floss. Successful exploitation can result in arbitrary code execution.
What is the remediation?
Upgrade Mandiant FLARE floss to version 3.2.0 or later. Until upgrading, do not process untrusted .viv or .exe.viv workspace files with floss.