CVE-2026-114198
Deserialization of untrusted data in floss
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility
| CWE | CWE-502 |
| Vendor | mandiant flare |
| Product | floss |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for mandiant flare floss
Be the first to know when new unknown vulnerabilities affecting mandiant flare floss are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Mandiant FLARE / floss
0 < 3.2.0