CVE-2026-114197
CVE-2026-114197 · Deserialization of untrusted data in capa
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility
CVSS 8.7 · High · EPSS 0.1% · Fix available
- Published
- Updated
Affected products and versions
capa
- Versions
- ≥ 0, < 10.0.0: Affected (semver)
Update to 10.0.0