Deserialization Flaw in Mandiant FLARE floss Allows Code Execution

Executive Summary

CVE-2026-114198 is a deserialization vulnerability in Mandiant FLARE floss versions before 3.2.0. It allows arbitrary code execution when a specially crafted .viv or .exe.viv workspace file is processed by the floss utility. The flaw occurs because floss automatically deserializes cached Vivisect workspace files in Python Pickle format, which can execute malicious code if the workspace is untrusted.

Useful 0 Not Useful 0

Detection Guidance

Check floss version with 'floss --version'. If it is below 3.2.0, the system is vulnerable. Inspect directories for .viv or .exe.viv files from untrusted sources. Monitor for unexpected processes or files created by floss.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary code execution in the floss environment. An attacker could exploit it by tricking a user into processing a malicious .viv or .exe.viv file. The exploitability is low as it requires user interaction or a malicious cached workspace, but the impact is high due to potential code execution.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling arbitrary code execution through malicious files. If exploited, it may lead to unauthorized data access, modification, or exfiltration, violating confidentiality and integrity requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade floss to version 3.2.0 or later immediately. Avoid processing .viv or .exe.viv files from untrusted sources. Remove any cached .viv files in floss directories. Restrict execution permissions for floss if possible.

Useful 0 Not Useful 0