Read the docs
TI-2026-78734 Aliases CVE-2026-114198

Deserialization of untrusted data in Mandiant FLARE floss

Priority LOW 39CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
High
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

Mandiant FLARE floss releases before 3.2.0 contain a deserialization of untrusted data flaw (CWE-502). A crafted .viv or .exe.viv workspace passed to the floss utility can lead to arbitrary code execution. Exploiting it requires a local user to be tricked into opening a crafted workspace, with high attack complexity and a prerequisite condition.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00152 4th percentileScored 2026-11-07
Fix Fixed floss (Mandiant FLARE): 3.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Mandiant FLAREflossbefore 3.2.03.2.0Patch availableCNA
  • floss VendorMandiant FLARE Affected before 3.2.0 Fixed in 3.2.0 Patch available CNA

Remediation

Update floss to version 3.2.0, which is not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA floss (Mandiant FLARE) Fixed in 3.2.0

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114198
  2. 2026-10-21 CISA SSVC decision points changed
  3. 2026-10-21 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2026-78733 Deserialization of untrusted data in Mandiant FLARE capa CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences