Floss
Monthly
Arbitrary code execution in Mandiant FLARE floss before 3.2.0 occurs when an analyst opens a crafted vivisect workspace (.viv or .exe.viv), because the utility deserializes the file without adequate trust checks. Exploitation is local and requires user interaction-the attacker must deliver a malicious workspace and persuade the victim to run floss on it-so it is a conditional risk concentrated in malware-analysis workflows rather than a remotely exploitable or mass-exploitation emergency. No public exploit code or confirmed active exploitation was identified in the available intelligence, and the vendor has fixed the issue in floss 3.2.0.
Arbitrary code execution in Mandiant FLARE floss before 3.2.0 occurs when an analyst opens a crafted vivisect workspace (.viv or .exe.viv), because the utility deserializes the file without adequate trust checks. Exploitation is local and requires user interaction-the attacker must deliver a malicious workspace and persuade the victim to run floss on it-so it is a conditional risk concentrated in malware-analysis workflows rather than a remotely exploitable or mass-exploitation emergency. No public exploit code or confirmed active exploitation was identified in the available intelligence, and the vendor has fixed the issue in floss 3.2.0.