Fuji Electric V-SFT CVE-2025-61859

Exploitation requires a victim to open a specially crafted V-SFT (.V8/.V9 project) file in Fuji Electric V-SFT version 6.2.7.0 or earlier; the flaw is in the is_motion_tween drawing-item parsing path (VS6ComFile!CItemDraw::is_motion_tween). It is NOT remotely triggerable: the CVSS 4.0 vector is local (AV:L) and mandates active user interaction (UI:A), so delivery depends on social engineering to get an engineer or operator to open the malicious file. Limiting factors that reduce realistic risk: the attacker must craft a valid-appearing malicious file, the victim must be running a vulnerable V-SFT version on an engineering/configuration workstation, and the software's niche ICS footprint narrows the target population. No special product configuration is required beyond having the vulnerable version installed and opening the file.

Signals here point to a moderate, non-urgent priority despite the 8.4 CVSS 4.0 score. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) describes a local, file-opening attack requiring active user interaction rather than remote exploitation, with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) and no scope change to subsequent systems. EPSS is low at 0.18% (7th percentile), indicating very low probability of exploitation in the near term, and this CVE is NOT listed in CISA KEV - so no public exploit identified at time of analysis. These signals are internally consistent: a client-side parser flaw in niche ICS engineering software that depends on tricking an operator into opening a malicious project file is a poor fit for mass, automated exploitation, which aligns with the low EPSS. No SSVC decision data was provided in the input. The PR:N metric technically denotes unauthenticated, but exploitation realistically hinges on social engineering (UI:A), not network reachability. Net: a genuine code-execution risk warranting patching on engineering workstations, but not an emergency given low real-world exploitation probability, no known POC, and the user-interaction and local-access prerequisites.

An attacker crafts a malicious V-SFT project file and delivers it to an engineer or operator (via email, shared drive, or USB), who opens it in a vulnerable V-SFT v6.2.7.0 or earlier installation. The out-of-bounds write in CItemDraw::is_motion_tween corrupts memory, allowing information disclosure, an abnormal application termination (ABEND), or arbitrary code execution on the engineering workstation. No public exploit code was identified in the provided data, so exploitation would require the attacker to develop a working trigger.