Mandiant FLARE floss EUVD-2026-106924

Exploitation requires the victim to pass an attacker-crafted vivisect workspace file (.viv or .exe.viv) to the FLARE floss command-line utility, which then insecurely deserializes the workspace and executes attacker-controlled code. There is no remote network surface: the attacker must first get the malicious workspace onto the target and the analyst must actively invoke floss on it (AV:L, UI:A/AT:P). Limiting factors: no special floss configuration is needed (default behavior is vulnerable in releases before 3.2.0), but exploitation depends entirely on social engineering an analyst into opening an untrusted, attacker-supplied workspace locally - a workflow largely confined to malware-analysis environments. Fixed in floss 3.2.0.

This is a genuine but conditional risk, not a mass-exploitation emergency. The input CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:N/UI:A) describes a LOCAL, user-interaction-dependent flaw: an analyst must actively pass a crafted .viv/.exe.viv workspace to the floss utility, so there is no remote or automatable attack surface despite the high 8.7 base score. The score is driven up by full C/I/A impact (arbitrary code execution via CWE-502 insecure deserialization), but the attack requirements (AT:P) and local vector sharply constrain real-world reach. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so by the precision rules this is 'no public exploit identified at time of analysis' - targeted, not widespread, exploitation is the realistic model. The signals are internally consistent (local vector + required user interaction + high impact), so there is no contradiction to flag; the main caveat is that EPSS/KEV/POC data are simply absent rather than conflicting, which should be treated as 'unknown' not 'safe'. Net: a credible RCE primitive against reverse-engineers who open untrusted samples, warranting prompt patching to 3.2.0 for teams that run floss, but low urgency relative to network-exploitable, auto-spreadable flaws.

An attacker crafts a malicious vivisect .viv (or .exe.viv) workspace containing a weaponized serialized object and distributes it as a shared malware sample, challenge file, or collaborative analysis artifact. When a malware analyst passes that workspace to floss, the untrusted data is deserialized (CWE-502) and attacker-controlled code executes in the context of the analyst's user account. No public exploit code was identified at time of analysis, but the technique is well-understood and the local attack requires the analyst to actively run floss against the crafted file.