Fuji Electric V-SFT CVE-2026-107896

Exploitation requires a user to open a maliciously crafted V7 file in Fuji Electric V-SFT on the local workstation (CVSS UI:A, AV:L). There is no network-facing attack surface and no authentication requirement beyond local user context (PR:N); the attacker instead needs a delivery/social-engineering step to get the crafted file in front of a V-SFT operator. Limiting factors: the victim must actively open the attacker-supplied file, the attacker needs it to reach an engineering workstation running V-SFT, and impact is confined to that system (SC/SI/SA:N) - there is no automated or self-propagating path.

This is a file-parsing memory-safety flaw (CWE-125 out-of-bounds read) in Fuji Electric V-SFT's VS6ComFile!load_gr_item routine, triggered when a user opens a crafted V7 file. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A, VC:H/VI:H/VA:H, score 8.4) describes a local, low-complexity attack requiring active user interaction but no privileges, with high confidentiality, integrity and availability impact to the vulnerable system only (SC/SI/SA:N). This is a client-side engineering-workstation risk, not a remotely reachable service: an attacker cannot trigger it without getting an operator to open a malicious file, which materially lowers real-world likelihood versus a network-exploitable bug. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit or PoC reference is present in the input - so there is no signal of active or imminent mass exploitation. The vuln.today decision label is 'this_week', indicating elevated-but-not-emergency priority. Signals are broadly consistent: high technical impact is offset by the local vector and required user interaction. Note the stated outcome spans 'information exposure OR arbitrary code execution' from a single OOB read primitive - the path to reliable code execution is not detailed in the available sources and should be treated as the vendor's worst-case rather than a confirmed capability.

An attacker crafts a malicious V7 project/screen file and delivers it to an HMI engineer or integrator (via email, a shared project repository, or a compromised supplier), relying on the fact that opening such files in V-SFT is routine. When the engineer opens the file, the out-of-bounds read in load_gr_item is triggered, leaking process memory or, in the worst case claimed by the vendor, executing attacker-controlled code on the engineering workstation. No public exploit identified at time of analysis; the attack requires user interaction (opening the file) and only local access to that workstation.