Mandiant FLARE capa CVE-2026-114197

Exploitation requires an analyst to run the capa utility (release before 10.0.0) against an attacker-crafted vivisect workspace file (.viv or .exe.viv), whose untrusted serialized contents are deserialized (CWE-502) to achieve code execution. Limiting factors: the vector is local only (AV:L) with no network exposure, and it is not triggered automatically - a user must actively pass the malicious workspace to capa (UI:A), and an additional attack requirement must be met (AT:P). Risk is confined to environments where analysts load untrusted/third-party workspace files; upgrading to capa 10.0.0 or later removes the condition.

The vendor CVSS 4.0 base score of 8.7 (High) is driven largely by full impact metrics (VC:H/VI:H/VA:H) and subsequent-system impact (SC:H/SI:H/SA:H), but the exploitability metrics tell a more measured story: AV:L (local), AC:H, AT:P (a specific attack requirement must be present), and UI:A (active user interaction required). This is NOT a remotely exploitable, mass-scannable flaw - it requires an analyst to actively run the capa utility against an attacker-supplied workspace file. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or probable widespread exploitation; the status is 'no public exploit identified at time of analysis.' The realistic threat model is targeted: an adversary who can get a malicious .viv/.exe.viv sample in front of a reverse engineer (e.g., via a malware sample shared for analysis). No SSVC decision data (exploitation/automatable/technical impact) was provided, so that framework cannot be applied. Net: the high CVSS reflects worst-case technical impact (code execution), but the local vector plus mandatory user interaction make this a moderate, targeted risk rather than a drop-everything priority - most urgent for malware-analysis teams who routinely load untrusted workspaces.

An attacker crafts a malicious vivisect (.viv or .exe.viv) workspace file containing a weaponized serialized object and delivers it to a malware analyst - for example, bundled with a sample submitted for 'analysis.' When the analyst runs the capa utility (version before 10.0.0) against the file, the untrusted data is deserialized and attacker-controlled code executes in the context of the analyst's user account. No public exploit code was identified at the time of analysis, and exploitation requires the analyst to actively process the file (AV:L, UI:A).