Fuji Electric Monitouch V-SFT CVE-2025-61856
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted V-SFT file to engineer
-
ExploitEngineer opens file in V-SFT application
-
ExecutionOverflow stack buffer in WriteV7DataToRom
-
ImpactExecute arbitrary code on engineering workstation
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a local user to open an attacker-supplied, specially crafted V-SFT file in the Fuji Electric Monitouch V-SFT application (v6.2.7.0 or earlier); this matches CVSS UI:A (active user interaction) and AV:L (local vector). The limiting factors that reduce real-world risk are: (1) mandatory user interaction - the malicious file must be delivered and manually opened, there is no remote or automatic trigger; (2) the attack surface is the V-SFT engineering/configuration software, not the deployed HMI panels or any network-facing service; and (3) the affected population is limited to operators/engineers running vulnerable V-SFT versions. No special product feature or non-default configuration is required beyond having the vulnerable software installed and processing the file. |
| Impact | This is a client-side file-parsing memory corruption flaw (CWE-121 stack-based buffer overflow) in Fuji Electric's Monitouch V-SFT HMI configuration software, and the signals converge on moderate, opportunistic risk rather than mass-exploitation urgency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) correctly characterizes it as a local, user-interaction-dependent vulnerability - the victim must open a malicious V-SFT project file - not a remotely reachable network service, so the 8.4 'HIGH' score reflects strong technical impact (VC:H/VI:H/VA:H: information disclosure, abnormal termination, and arbitrary code execution) rather than ease of remote attack. EPSS is low at 0.20% (9th percentile), consistent with a vulnerability requiring social engineering and a niche ICS target audience; there is no CISA KEV listing and no public exploit (POC) referenced in the data, so there is no evidence of active exploitation or weaponization. No SSVC decision data was provided. Net: real but not emergency - prioritize patching for engineering workstations running V-SFT, but it does not warrant the drop-everything response of a wormable, network, unauthenticated RCE. |
| Exploit ScenarioDerived | An attacker crafts a malicious V-SFT project/configuration file and delivers it to an HMI engineer or operator (e.g., via spear-phishing email, shared project repository, or removable media). When the victim opens the file in V-SFT v6.2.7.0 or earlier, the CV7BaseMap::WriteV7DataToRom routine overflows a stack buffer, enabling information disclosure, a crash (ABEND), or arbitrary code execution on the engineering workstation. No public exploit code is identified at time of analysis, and successful attack depends on the local user interaction of opening the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Stack-based buffer overflow in Fuji Electric's Monitouch V-SFT HMI configuration software (v6.2.7.0 and earlier) lets an unauthenticated local attacker achieve code execution, information disclosure, and abnormal termination when a user opens a specially crafted V-SFT project file. The flaw is a memory-corruption write in VS6ComFile!CV7BaseMap::WriteV7DataToRom and is reachable only through the local file-parsing path, so exploitation hinges on convincing an engineer or operator to open a malicious project file (CVSS 4.0 base 8.4; independently assessed CVSS 3.1 8.4 with AV:L/UI:R). No public exploit has been identified at time of analysis, EPSS is a low 0.20% (9th percentile), and the software has not been added to CISA KEV, which together point to moderate, targeted risk affecting engineering workstations rather than deployed HMI panels.
RemediationAI
Obtain the current V-SFT release from Fuji Electric's Monitouch download portal (https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php) and confirm with the vendor/JVN advisory JVNVU90008453 (https://jvn.jp/en/vu/JVNVU90008453/) that the build addresses this stack overflow; the supplied data does not include an explicit fixed version string, so the patched build number must be confirmed from the vendor before treating the workstation as remediated. Until an updated build is installed, treat every V-SFT project file as untrusted: block or strip .v-sft/project attachments at email and web gateways, and reject project files received from outside the engineering team, since delivery plus user-open is the entire exploit chain. Enforce Mark-of-the-Web/attachment controls and application allowlisting so project files cannot be launched from downloads or removable media, and run V-SFT inside a dedicated, low-privilege engineering VM or sandboxed workstation - the trade-off is that USB, serial, and network drivers used to program panels may need passthrough configuration, and non-persistent sandboxes complicate ongoing project workflows. Enable crash reporting and treat any unexpected ABEND during project open as a potential exploitation attempt, preserving the offending file for analysis. Note that vulnerability scanners and network defenses will not detect this issue, because there is no network-facing service to probe; detection depends on endpoint controls and file-handling policy.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-121 stack-based buffer overflow occurring inside the V-SFT project-file loader, specifically in the module VS6ComFile and the method CV7BaseMap::WriteV7DataToRom. V-SFT is Fuji Electric's engineering and screen-design environment for Monitouch HMI terminals; its native project format embeds complex structures (screens, map objects, ROM data blocks) that the parser deserializes when a project is opened. The affected routine writes V7 map data into ROM structures, and the absence of adequate length validation on attacker-controlled field(s) allows data to be copied past the bounds of a stack buffer, overwriting adjacent stack memory including saved state and return addresses. Because the overwrite is attacker-directed, the practical outcomes range from a crash/abnormal end (ABEND) and memory-disclosure of stack contents to full arbitrary code execution in the context of the V-SFT process. The local (AV:L) attack vector with active user interaction (UI:A) is inherent to the design: the file is loaded by the desktop application and there is no network-facing service in the vulnerable component. The published CPE cpe:2.3:a:fujielectric:monitouch_v-sft:*:*:*:*:*:*:*:* confirms the entire unversioned V-SFT product line through v6.2.7.0 is in scope. Note that this is a client-side parser flaw in the configuration tooling, not in the runtime firmware of deployed Monitouch HMI panels, which materially narrows the attack surface.
Know when Monitouch V Sft gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
File must be opened locally by a user, so AV:L and UI:R; no prior privileges needed (PR:N); crafted-file parsing reliably triggers the overflow (AC:L) yielding full code-execution impact (C/I/A:H).
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
DescriptionCVE.org
A stack-based buffer overflow vulnerability exists in VS6ComFile!CV7BaseMap::WriteV7DataToRom of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
Executive ViewAI
Fuji Electric's Monitouch V-SFT HMI configuration software (v6.2.7.0 and earlier) contains a high-severity buffer overflow that can be triggered when an engineer opens a malicious project file. This vulnerability puts engineering workstations at risk of code execution, information disclosure, and crashes, potentially enabling attackers to disrupt industrial operations or steal sensitive configuration data. No vendor-released patch identified at time of analysis, so leadership should prioritize interim mitigations to protect critical engineering assets.
Implement strict access controls to limit who can open V-SFT project files, enforce application whitelisting, educate engineers to only open trusted project files, isolate engineering workstations from untrusted networks, enable logging and monitoring for suspicious file activity, and consider sandboxing or virtualizing the application to contain potential exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Monitouch V Sft
View allA Heap-Based Buffer Overflow was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. Rated h
A Stack-Based Buffer Overflow issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0.
Fuji Electric Monitouch V-SFT is vulnerable to a type confusion, which could cause a crash or code execution. Rated high
Fuji Electric Monitouch V-SFT is vulnerable to an out-of-bounds write because of a type confusion, which could result in
Fuji Electric Monitouch V-SFT is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute a
An out-of-bounds read in Fuji Electric's Monitouch V-SFT HMI configuration software (version 6.2.7.0 and earlier) allows
Out-of-bounds write in Fuji Electric V-SFT 6.2.7.0 and earlier can let a crafted V-SFT project file cause information di
Opening a specially crafted V-SFT project file in Fuji Electric Monitouch V-SFT 6.2.7.0 and earlier can trigger an out-o
Out-of-bounds write in Fuji Electric's MONITOUCH V-SFT HMI configuration tool (v6.2.7.0 and earlier) allows an attacker
Use-after-free memory corruption in Fuji Electric's Monitouch V-SFT engineering software (v6.2.7.0 and earlier) allows a
Opening a specially crafted V-SFT project file in Fuji Electric Monitouch V-SFT 6.2.7.0 or earlier can trigger an out-of
Arbitrary code execution and information disclosure in Fuji Electric Monitouch V-SFT 6.2.7.0 and earlier can be triggere
GitHub PoC
Exploit-DB