CVE-2026-114198: CWE-502: Deserialization of Untrusted Data in Mandiant FLARE floss

CVE-2026-114198 is a deserialization of untrusted data vulnerability in Mandiant FLARE floss releases prior to version 3.2.0. When a specially crafted .viv or .exe.viv workspace file is passed to the floss utility, it can lead to arbitrary code execution. The vulnerability is due to unsafe handling of serialized data, which an attacker can exploit by providing malicious workspace files. The CVSS 4.0 score is 8.7, indicating high severity with local attack vector, high complexity, partial privileges required, and user interaction necessary.

Successful exploitation allows an attacker to execute arbitrary code on the system running the vulnerable floss utility. This could lead to compromise of the local environment where floss is executed. The attack requires the victim to open a crafted workspace file, limiting remote exploitation but posing a significant risk in scenarios where untrusted files are processed.

Users should upgrade floss to version 3.2.0 or later where this vulnerability is fixed. No vendor advisory or patch link was provided, but the affected versions are explicitly stated as prior to 3.2.0. Until upgrading, avoid opening untrusted .viv or .exe.viv workspace files with floss.