CVE-2026-114198
CVE-2026-114198 · Deserialization of untrusted data in floss
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility
CVSS 8.7 · High · EPSS 0.1% · Fix available
- Published
- Updated
Affected products and versions
floss
- Versions
- ≥ 0, < 3.2.0: Affected (semver)
Update to 3.2.0