CVE-2026-114198 in Floss
Summary
by MITRE • 10/22/2026
Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified as CVE-2024-10795 represents a critical security flaw within Mandiant FLARE FLOSS, specifically affecting versions prior to 3.2.0. This issue stems from an insecure deserialization mechanism that fails to validate the integrity or origin of data structures before processing them. The vulnerability is triggered when a user passes a crafted workspace file with extensions such as .viv or .exe.viv to the floss utility for analysis. These files are designed to store state and configuration information, but in vulnerable versions, they can be manipulated by an attacker to contain maliciously serialized objects rather than legitimate data structures.
From a technical perspective, this flaw is classified under CWE-502, which denotes Deserialization of Untrusted Data. The underlying issue arises because the application relies on Python's pickle module or similar serialization libraries without implementing sufficient safeguards against arbitrary object instantiation. When the utility loads these workspace files, it reconstructs objects from the serialized stream. An attacker can craft a payload that exploits this reconstruction process to execute arbitrary system commands during the deserialization phase. This bypasses standard input validation because the vulnerability occurs at the level of object initialization rather than simple string parsing or buffer overflow conditions.
The operational impact of this vulnerability is severe, allowing for Remote Code Execution if an analyst opens a malicious workspace file provided by a threat actor or downloaded from an untrusted source. In the context of malware analysis and reverse engineering, analysts frequently handle samples from unknown origins. If FLOSS processes such a sample's associated workspace data without proper sanitization, it can lead to full compromise of the analyst's workstation. This not only jeopardizes the integrity of the investigation environment but also potentially exposes sensitive intellectual property or network credentials stored on the machine running the analysis tools.
This vulnerability aligns with MITRE ATT&CK technique T1203, which covers Exploitation for Client Execution, as it involves tricking a user into executing code through a seemingly benign file format used by security professionals. It also relates to CWE-94, Improper Control of Generation of Code (Code Injection), since the deserialization process effectively allows an attacker to inject and execute arbitrary logic within the application's runtime environment. The attack vector is primarily local or network-based depending on how the workspace files are distributed, but it requires user interaction to open the crafted file in the FLOSS interface or command line tool.
Mitigation strategies focus heavily on updating software components and adopting secure coding practices for data handling. Users must immediately upgrade Mandiant FLARE FLOSS to version 3.2.0 or later, where this deserialization flaw has been patched by implementing stricter validation checks before processing workspace files. Additionally, security teams should enforce strict input validation policies that reject any serialized data from untrusted sources unless it can be cryptographically verified. Implementing allowlists for permitted object types during deserialization and avoiding the use of inherently unsafe serialization formats like pickle in favor of safer alternatives such as JSON or XML with schema validation are recommended long-term remediation steps to prevent similar vulnerabilities in future software development cycles.