Mandiant FLARE capa: Deserialization of untrusted data allows code execution
Summary
capa, an open-source tool from Mandiant FLARE for identifying capabilities in executable files, deserializes cached Vivisect workspace files (.viv) without adequate checks. An attacker who provides a crafted .viv file or a crafted cached workspace next to a sample can execute code on the system of the analyst who runs capa. Exploitation requires the victim to run capa on attacker-supplied files, and the issue is rated high severity (CVSS v4.0 8.7) with no known exploitation.
Affected
- Mandiant FLARE capa versions before 10.0.0
Fixed in
- Upgrade to capa 10.0.0 or later
Workaround
- Keep the environment variable CAPA_LOAD_VIV_WORKSPACE unset (vendor change in 10.0.0 loads existing workspace files only when it is set to 1)
- Do not analyse samples that come with untrusted .viv files
- Run capa in an isolated analysis virtual machine
Exploitation
- CISA SSVC: exploitation none, automatable no
- Not listed as known exploited
- No public proof of concept found; status unknown rather than confirmed absent
Our recommendation
- Find all capa installations, including Python environments, scripts and portable copies, and upgrade them to 10.0.0 or later
- Until upgraded, keep CAPA_LOAD_VIV_WORKSPACE unset and avoid samples bundled with .viv files
- Check whether the related tool floss is deployed and upgrade it to 3.2.0 or later
- Re-check the vendor advisory and NVD once they are analysed
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MNDT-2026-0035 Mandiant advisory github.com
- capa releases github.com
- OpenCVE CVE-2026-114197 app.opencve.io
- HOL Guard CVE-2026-114197 hol.org
- capa documentation mandiant.github.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:05.
Original description (NVD)
Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.