Monitouch V-SFT
CVE-2025-61864
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted V-SFT project file to engineer
-
DeliveryVictim opens file in V-SFT
-
ExploitTrigger use-after-free in load_link_inf
-
ExecutionExecute arbitrary code on engineering workstation
-
ImpactInformation disclosure and compromise of OT host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to open a specially crafted V-SFT project/configuration file within Monitouch V-SFT v6.2.7.0 or earlier - the vulnerable path is the load_link_inf function in the VS6ComFile component, reached during file parsing. There is no remote or network-exposed trigger: the attack vector is local (AV:L) and mandatory user interaction (UI:A) limits exploitation to social-engineering or supply-chain delivery of a malicious project file. No special product configuration or feature toggle is required beyond opening the file in the affected engineering application, but the attacker must get their file in front of an operator, and only affected versions (≤6.2.7.0) are vulnerable, which bounds realistic risk. |
| Impact | This is a client-side file-parsing use-after-free (CWE-416) in the VS6ComFile!load_link_inf routine of Fuji Electric's Monitouch V-SFT engineering software. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A, score 8.4) is internally consistent with the description: the attack vector is LOCAL and requires user interaction (UI:A) because a victim must open a specially crafted V-SFT project file - this is not a remotely reachable network service, so the 8.4 'high' rating reflects severe impact (full C/I/A compromise of the engineering workstation) rather than ease of mass exploitation. The EPSS score is low (0.17%, 6th percentile), which is consistent with a local, user-interaction-gated bug in niche ICS tooling rather than an internet-facing flaw. No CISA KEV listing and no public exploit were provided, so there is no public exploit identified at time of analysis. Net: this is a real and serious code-execution risk for engineers who open untrusted V-SFT files, but it is a targeted/social-engineering threat (spear-phishing an OT engineer with a malicious project file) rather than a mass-exploitable or wormable issue - prioritize patching for ICS/HMI engineering stations while recognizing the practical exploitation barrier of required user action. |
| Exploit ScenarioDerived | An attacker crafts a malicious V-SFT project (.V8 / configuration) file and delivers it to an engineer - via email, a shared drive, or a compromised project repository - who opens it in Monitouch V-SFT v6.2.7.0 or earlier. Parsing the file in load_link_inf triggers a use-after-free, allowing information disclosure, a crash (ABEND), or arbitrary code execution in the context of the engineer's workstation. No public exploit was identified at time of analysis; exploitation requires the victim to open the file (UI:A). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Use-after-free memory corruption in Fuji Electric's Monitouch V-SFT engineering software (v6.2.7.0 and earlier) allows an attacker to trigger information disclosure, abnormal application termination (ABEND), or arbitrary code execution when a specially crafted V-SFT project/configuration file is opened in the affected application. The flaw lies in the VS6ComFile!load_link_inf routine reached during file parsing; the attack vector is local and requires the victim to open a malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, vendor score 8.4), so exploitation depends on social-engineering or supply-chain delivery of a crafted project file rather than a network-exposed trigger. EPSS is low at 0.17% (6th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
No fixed version is specified in the available advisory data, so the primary action is to obtain the latest Monitouch V-SFT build from Fuji Electric's download portal (https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php) and monitor JVN advisory JVNVU90008453 (https://jvn.jp/en/vu/JVNVU90008453/) for an updated release that addresses CVE-2025-61864; if an upgrade beyond 6.2.7.0 is published, apply it immediately. Until a patched build is confirmed, treat V-SFT project files as untrusted input: never open project, configuration, or link-definition files received from outside the organization or from an unverified source, since delivery of a crafted file is the sole trigger. Enforce this through email/web gateway attachment filtering that strips or quarantines .v6/.v-sft-style project files, and validate files received through supply-chain channels before use. Run the engineering application in a dedicated, non-networked VM or sandbox with a low-privilege account and application-level exploit mitigations (e.g., Windows Defender Exploit Guard/ASLR and CFG enabled) so that a successful memory-corruption attempt cannot pivot to the host or the production network; the trade-off is reduced convenience and performance for engineers and the need for a controlled file-transfer process. Restrict local logon to V-SFT workstations to authorized engineering staff and remove unnecessary local administrator rights, which lowers the value of code execution in the application's context. None of these compensating controls fix the underlying use-after-free, so they should be considered temporary until vendor patching is available.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in the VS6ComFile component of Fuji Electric's Monitouch V-SFT, a Windows-based engineering/configuration tool used to program and manage Monitouch HMI terminals. The affected code path is the load_link_inf function, which processes link/connection definitions embedded in V-SFT project files; a malformed file causes a heap object to be freed and then dereferenced, yielding memory corruption that can leak memory contents, crash the process (ABEND), or, under attacker control of the freed allocation, achieve arbitrary code execution in the context of the V-SFT application. The CPE record cpe:2.3:a:fujielectric:monitouch_v-sft:*:*:*:*:*:*:*:* confirms the target is the vendor's V-SFT product line through version 6.2.7.0. Because the trigger is a locally supplied file rather than a network service, the practical exposure is bounded by the need to convince an operator to open an attacker-supplied project file.
Know when Monitouch V Sft gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
File must be opened locally by a user so AV:L and UI:R; no prior privileges needed (PR:N); use-after-free yields full code execution giving high C/I/A with no scope change.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
DescriptionCVE.org
A use after free vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
Executive ViewAI
Fuji Electric's Monitouch V-SFT engineering software (v6.2.7.0 and earlier) contains a memory-corruption flaw that can be triggered when a user opens a crafted project file, potentially handing an attacker control of the workstation that programs production HMIs. Because these workstations often hold proprietary control logic and sit adjacent to operational technology networks, a single successful compromise could expose intellectual property and provide a bridge into plant systems. No vendor patch is currently available, though exploitation depends on social engineering or a compromised project file reaching an engineer, which keeps near-term likelihood low while leaving impact high.
No vendor-released patch identified at time of analysis; interim mitigations include treating all externally supplied V-SFT project files as untrusted, filtering and quarantining such files at email and web gateways, running Monitouch V-SFT under least-privilege or virtualized/isolated environments, enforcing application allowlisting and endpoint detection on engineering workstations, and restricting those workstations' network reach to limit lateral movement pending a vendor fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Monitouch V Sft
View allA Heap-Based Buffer Overflow was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. Rated h
A Stack-Based Buffer Overflow issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0.
Fuji Electric Monitouch V-SFT is vulnerable to a type confusion, which could cause a crash or code execution. Rated high
Fuji Electric Monitouch V-SFT is vulnerable to an out-of-bounds write because of a type confusion, which could result in
Fuji Electric Monitouch V-SFT is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute a
Stack-based buffer overflow in Fuji Electric's Monitouch V-SFT HMI configuration software (v6.2.7.0 and earlier) lets an
An out-of-bounds read in Fuji Electric's Monitouch V-SFT HMI configuration software (version 6.2.7.0 and earlier) allows
Out-of-bounds write in Fuji Electric V-SFT 6.2.7.0 and earlier can let a crafted V-SFT project file cause information di
Opening a specially crafted V-SFT project file in Fuji Electric Monitouch V-SFT 6.2.7.0 and earlier can trigger an out-o
Out-of-bounds write in Fuji Electric's MONITOUCH V-SFT HMI configuration tool (v6.2.7.0 and earlier) allows an attacker
Opening a specially crafted V-SFT project file in Fuji Electric Monitouch V-SFT 6.2.7.0 or earlier can trigger an out-of
Arbitrary code execution and information disclosure in Fuji Electric Monitouch V-SFT 6.2.7.0 and earlier can be triggere
GitHub PoC
Exploit-DB