A flaw in Mandiant FLARE capa allows code execution when a specially crafted .viv or .exe.viv file is supplied to the tool. The vulnerability is a result of deserializing untrusted data, which can trigger arbitrary code execution if an attacker can supply a malicious workspace file. The weakness is identified as CWE-502 and can compromise confidentiality, integrity, and availability of the system where capa is run.

The affected product is Mandiant FLARE capa. All releases prior to version 10.0.0 are vulnerable. Any installation that runs capa on a system where an attacker can provide a crafted workspace file is at risk.

The CVSS score of 8.7 indicates a high severity vulnerability, but the EPSS score of less than 1% shows a very low predicted exploitation probability at this time. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is local, requiring the attacker to provide or trigger the loading of a malicious workspace file within capa. If a user runs capa with such a file, the attacker can achieve arbitrary code execution on the host where capa is executed.