Deserialization Flaw in Mandiant FLARE Capa Allows Code Execution

Executive Summary

CVE-2026-114197 is a deserialization vulnerability in Mandiant FLARE capa versions before 10.0.0. It allows arbitrary code execution when processing specially crafted .viv or .exe.viv workspace files. The issue occurs because capa automatically deserializes cached Vivisect workspace files using Python Pickle format, enabling untrusted workspaces to execute malicious code.

Useful 0 Not Useful 0

Detection Guidance

Check for Mandiant FLARE capa versions prior to 10.0.0 by running capa --version. Look for suspicious .viv or .exe.viv files in directories where capa processes files. Monitor for unexpected code execution or system changes after processing these files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary code execution if you open a crafted .viv or .exe.viv file or if a malicious cached workspace exists in the same directory. It requires user interaction but has a high impact due to potential system compromise. The CVSS score is 8.7, indicating high severity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling arbitrary code execution through malicious workspaces. If exploited, it may lead to unauthorized data access, modification, or exfiltration, violating confidentiality and integrity requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Mandiant FLARE capa to version 10.0.0 or later immediately. Remove any untrusted .viv or .exe.viv files from directories where capa operates. Avoid opening or processing suspicious workspace files until patched.

Useful 0 Not Useful 0