The flaw is a deserialization vulnerability in the Mandiant FLARE floss tool that allows an attacker to craft .viv or .exe.viv workspace files that, when supplied to floss, cause arbitrary code execution. This weakness is a classic example of improper deserialization, which can be exploited to run malicious code with the privileges of the user running floss. The primary consequence is loss of confidentiality, integrity, and availability of the affected system.

Affected products include the Mandiant FLARE floss utility in all releases prior to version 3.2.0. Any installation of floss that accepts untrusted workspace files is vulnerable.

The CVSS score of 8.7 indicates a high severity. The EPSS score of less than 1% suggests that, at this time, the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or network-based file upload; an attacker must supply a crafted workspace file to floss, which then deserializes it without proper validation. If successful, arbitrary code execution occurs under the process owner’s privileges. Given the high impact but low exploitation probability, continuous monitoring and prompt remediation are advised.