Fuji Electric V-SFT
CVE-2025-61857
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious V-SFT project file
-
DeliveryDeliver to HMI engineer via phishing/shared drive
-
ExploitVictim opens file in V-SFT
-
ExecutionTrigger out-of-bounds write in WinFontDynStrCheck
-
ImpactExecute arbitrary code on engineering workstation
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a user running V-SFT v6.2.7.0 or earlier to open a specially crafted V-SFT file (UI:A, local vector AV:L); there is no network-reachable path and no authentication requirement (PR:N). Exploitation is gated by social engineering - the attacker must induce the victim to open an attacker-supplied project file - and by the victim running a vulnerable version. This is a client-side file-parsing flaw in Fuji Electric's HMI configuration tool, not a server-side or default-exposed service, which materially limits opportunistic exploitation. |
| Impact | Signals are consistent and point to a serious-but-not-urgent client-side flaw rather than a mass-exploitation priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) confirms this is a LOCAL, user-interaction-dependent vulnerability - it is not remotely reachable over a network; an engineer must actively open a malicious V-SFT file. Impact is high across the board (VC:H/VI:H/VA:H), matching the description's information disclosure, ABEND, and arbitrary code execution outcomes and the CWE-787 out-of-bounds write. Mitigating this, EPSS is only 0.18% (7th percentile), there is no CISA KEV listing (not actively exploited per available data), and no public exploit (POC) was identified in the provided intelligence. No SSVC decision data was supplied. The one tension to flag: PR:N labels this 'unauthenticated,' but exploitation still requires a human to be tricked into opening a crafted file (UI:A), so raw CVSS severity (8.4) overstates real-world ease compared to the low EPSS. Net: a genuine code-execution risk for engineering workstations but low likelihood of opportunistic mass exploitation; prioritize patching for teams that routinely open third-party or untrusted V-SFT project files. |
| Exploit ScenarioDerived | An attacker crafts a malicious V-SFT project file and delivers it to an HMI/control-systems engineer via phishing email, a shared drive, or a compromised project repository. When the engineer opens the file in V-SFT v6.2.7.0 or earlier, the out-of-bounds write in CItemExChange::WinFontDynStrCheck corrupts memory, enabling information disclosure, a crash (ABEND), or arbitrary code execution on the engineering workstation. No public exploit code was identified at time of analysis, and exploitation requires the local file-open action (UI:A). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Out-of-bounds write in Fuji Electric's MONITOUCH V-SFT HMI configuration tool (v6.2.7.0 and earlier) allows an attacker who convinces a user to open a specially crafted V-SFT project file to corrupt memory and achieve information disclosure, abnormal termination (ABEND) of the application, or arbitrary code execution in the context of the victim user. Per the CVSS vector the flaw requires no authentication (PR:N) but is a local/client-side issue (AV:L) gated by user interaction (UI:A), so exploitation depends on social engineering rather than any network-reachable service. Exploitation status: no public exploit identified at time of analysis, and EPSS is very low at 0.18% (7th percentile), indicating limited expected opportunistic activity; the vendor-accepted CVSS 4.0 score is 8.4, and the independent assessment rates the same issue as CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
RemediationAI
No vendor-released patch version is identified in the provided data, so the first action is to consult the JVN advisory at https://jvn.jp/en/vu/JVNVU90008453/ and Fuji Electric's V-SFT distribution page at https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php to confirm the fixed build and upgrade V-SFT on every engineering workstation - do not assume a version number beyond 6.2.7.0 is safe until the vendor confirms it. Until an update is applied, the practical compensating controls target the delivery vector: treat V-SFT project files as executable content, refuse files received via email, chat, or removable media unless the sender and hash are verified, and restrict ingestion to a defined trusted repository (trade-off: legitimate project sharing and customer-supplied projects become slower to handle). Run V-SFT under a least-privilege Windows account rather than an administrator account, and open untrusted project files only inside a disposable VM or sandbox that mirrors the engineering environment (trade-off: hardware dongles, license servers, and PLC communications may not pass through cleanly, so this is best used for triage rather than daily work). Ensure OS-level exploit mitigations (ASLR, DEP, CFG) and EDR/application-crash telemetry are enabled and alert on VS6ComFile or V-SFT faults, since an ABEND following the opening of an externally supplied file is a likely exploitation indicator; these measures reduce reliability of code execution but do not eliminate the underlying out-of-bounds write, so patching remains the only complete fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a CWE-787 out-of-bounds write in the VS6ComFile component, specifically the function CItemExChange::WinFontDynStrCheck, which handles font-related metadata while parsing V-SFT project files. Because these files are structured binary/container documents consumed by a GUI authoring tool, the parsing path trusts length or offset fields in the file, and a crafted font reference can cause writes past the end of an allocated buffer - a classic memory-corruption condition that can leak adjacent memory (information disclosure), crash the process (ABEND), or redirect control flow to attacker-supplied code when combined with suitable heap layout and the process's existing mitigations. The CPE cpe:2.3:a:fujielectric:monitouch_v-sft:*:*:*:*:*:*:*:* identifies MONITOUCH V-SFT as the affected application, and the JVN advisory JVNVU90008453 reflects a coordinated disclosure reported by JPCERT/CC (vultures@jpcert.or.jp). The root cause class - a file-parsing buffer overflow in a desktop engineering tool - is the same pattern seen repeatedly in HMI/SCADA project-file parsers, where engineering workstations become the practical attack surface rather than the controllers themselves.
Know when Monitouch V Sft gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
File must be opened locally by a user (AV:L, UI:R) with no prior privileges (PR:N); out-of-bounds write yields full code execution, so C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
DescriptionCVE.org
An out-of-bounds write vulnerability exists in VS6ComFile!CItemExChange::WinFontDynStrCheck of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
Executive ViewAI
Fuji Electric MONITOUCH V-SFT HMI configuration tool (v6.2.7.0 and earlier) has a high-severity local memory-corruption flaw that can be triggered when a user opens a malicious project file. This affects engineering and operations staff who configure HMIs, and successful exploitation could allow code execution in the user’s context or disrupt configuration activities. Leadership should care because compromised engineering workstations may provide a foothold into industrial control environments, even though no public exploit has been identified and exploitation requires user interaction.
No vendor-released patch identified at time of analysis; interim mitigations include restricting V-SFT project files to trusted sources, blocking untrusted email and web downloads of such files, scanning files before opening, applying application allowlisting and endpoint detection/response on engineering workstations, running V-SFT with least privilege, isolating HMI engineering workstations from general IT networks, and monitoring for abnormal V-SFT termination (ABEND) or suspicious child processes. Monitor Fuji Electric advisories for a vendor-released patch and test it in a controlled environment once available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Monitouch V Sft
View allA Heap-Based Buffer Overflow was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. Rated h
A Stack-Based Buffer Overflow issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0.
Fuji Electric Monitouch V-SFT is vulnerable to a type confusion, which could cause a crash or code execution. Rated high
Fuji Electric Monitouch V-SFT is vulnerable to an out-of-bounds write because of a type confusion, which could result in
Fuji Electric Monitouch V-SFT is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute a
Stack-based buffer overflow in Fuji Electric's Monitouch V-SFT HMI configuration software (v6.2.7.0 and earlier) lets an
An out-of-bounds read in Fuji Electric's Monitouch V-SFT HMI configuration software (version 6.2.7.0 and earlier) allows
Out-of-bounds write in Fuji Electric V-SFT 6.2.7.0 and earlier can let a crafted V-SFT project file cause information di
Opening a specially crafted V-SFT project file in Fuji Electric Monitouch V-SFT 6.2.7.0 and earlier can trigger an out-o
Use-after-free memory corruption in Fuji Electric's Monitouch V-SFT engineering software (v6.2.7.0 and earlier) allows a
Opening a specially crafted V-SFT project file in Fuji Electric Monitouch V-SFT 6.2.7.0 or earlier can trigger an out-of
Arbitrary code execution and information disclosure in Fuji Electric Monitouch V-SFT 6.2.7.0 and earlier can be triggere
GitHub PoC
Exploit-DB