EUVD-2026-109627
GHSA-7f8c-2jq9-r6j7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted V7 file to operator
-
ExploitOperator opens file in V-SFT
-
ExecutionOut-of-bounds read in set_temp_type_default
-
ImpactMemory disclosure or code execution on workstation
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to supply a specially crafted V7 project file and requires a user of V-SFT (Fuji Electric / Hakko Electronics) to actively open that file - the active user interaction (UI:A) and local vector (AV:L) are the primary limiting factors. No authentication or elevated privileges are needed (PR:N), and it affects the product when a malicious file is processed by the VS6MemInIF!set_temp_type_default routine. There is no remote network-triggerable path; risk is confined to workstations where the V-SFT application is installed and an operator can be induced to open attacker-controlled project files. |
| Impact | This is a genuine but conditional priority, not a mass-exploitable emergency. The CVSS 4.0 vector (score 8.4) is explicitly local (AV:L) and requires active user interaction (UI:A) - the victim must open a crafted V7 project file - with no privileges needed (PR:N) and high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H). This profile is consistent with a client-side file-parsing flaw in engineering/HMI software, not a remotely reachable network service. The vuln.today decision label is 'this_week' (reported by JPCERT/JVN), which argues for prompt but not emergency patching. No EPSS probability is supplied in the input, there is no CISA KEV listing, and no public exploit code is referenced (the two references are the Fuji Electric advisory and the JVN entry, not a PoC). The CWE is CWE-125 (out-of-bounds read); the description claims it 'may lead to' information exposure OR arbitrary code execution, but the sources do not describe the trigger mechanism or how an OOB read escalates to code execution, so the RCE outcome is stated by the vendor but its mechanism is unverified. Overall: a legitimate high-severity client-side ICS vulnerability whose real-world risk is bounded by the need to socially engineer an operator into opening a malicious file. |
| Exploit ScenarioDerived | An attacker crafts a malicious V7 project file and delivers it to an engineer or operator (e.g. via email, a shared project repository, or a USB drive). When the victim opens the file in V-SFT, the out-of-bounds read in VS6MemInIF!set_temp_type_default is triggered, leading to information exposure or potentially arbitrary code execution on the engineering workstation. No public exploit code is referenced in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Opening a crafted V7 project file in Fuji Electric's V-SFT screen-creation/engineering software can drive an out-of-bounds read in the VS6MemInIF!set_temp_type_default routine, exposing process memory and, per the vendor, potentially enabling arbitrary code execution on the workstation running the application. Rated 8.4 (CVSS 4.0, CWE-125) and tracked by JPCERT/CC, the issue is conditional rather than mass-exploitable: the attack vector is local and the victim must actively open an attacker-supplied project file, while no authentication or special privileges are required for the payload to be processed. No public exploit identified at time of analysis, no CISA KEV listing, and the vendor advisory plus JVN note are the primary sources for version and fix guidance.
RemediationAI
Patch status is not confirmed in the available data: no fixed build number appears in the supplied sources, so the first action is to pull the current Fuji Electric advisory (https://felib.fujielectric.co.jp/en/M10010/M20060/document_detail/5d9dd71d-9494-41a4-aa5c-8e6b8b21066b?region=en-glb) and the JVN page (https://jvn.jp/en/vu/JVNVU96549652/) to identify the corrected V-SFT release and upgrade to it. Until a fixed build is applied, the exposure is defined by file handling rather than by network reachability: restrict V-SFT workstations to opening V7 project files that originate from trusted internal sources or that have been exchanged over authenticated channels, and treat project files received by email, download or removable media as untrusted, since opening such a file is the sole condition for triggering the out-of-bounds read. The trade-off is operational friction for engineers who routinely receive vendor or partner project files, so route those through a review or scanning step rather than blocking them outright, and keep V-SFT installations off general-purpose browsing and mail endpoints where attacker-supplied files are commonly received.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The weakness is an out-of-bounds read (CWE-125) in the V-SFT code path that parses V7 project files, specifically inside the routine exported as VS6MemInIF!set_temp_type_default. V-SFT project files are structured binary containers that the editor parses to reconstruct screens, objects and internal memory/type metadata; a malformed file can cause the parser to read past the end of an allocated buffer, so the impact class spans both disclosure of adjacent memory and, where the over-read corrupts or feeds downstream logic, possible code execution as described by the vendor. The assessed vector (CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms this is a file-processing flaw reachable only on a host where V-SFT is installed and only when a user opens the weaponized project file - there is no remotely triggerable network path and no privilege prerequisite. The supplied sources identify the affected software through the CPE cpe:2.3:a:fuji_electric_co.,_ltd._/_hakko_electronics_co.,_ltd.:v-sft without version constraints, so the exact affected build range and the specific parser structures involved in the over-read are not enumerated in the available data; the trigger mechanics beyond 'crafted V7 file opened in V-SFT' are not described in the available sources.
Know when V Sft gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
File must be opened locally in V-SFT so AV:L and UI:R; no auth needed (PR:N); crafted-file parsing yields high C/I/A per vendor's info-exposure-or-RCE claim.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
2DescriptionCVE.org
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
Executive ViewAI
Fuji Electric's V-SFT engineering software contains an unpatched high-severity vulnerability (CVE-2026-107897) that can be triggered when an operator opens a malicious V7 project file, potentially leading to memory disclosure or arbitrary code execution on the engineering workstation. This puts engineering teams and critical infrastructure operations at risk, as these workstations often have privileged network access and are used to manage industrial control systems.
No vendor-released patch identified at time of analysis. Interim mitigations include user awareness training to avoid opening untrusted project files, application allowlisting to restrict execution of V-SFT and related processes, endpoint detection and response monitoring for anomalous memory access patterns, and network segmentation to limit lateral movement from engineering workstations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Opening a crafted V7 project file in Fuji Electric V-SFT (the HMI screen-configuration and programming software, listed
Out-of-bounds read in Fuji Electric V-SFT can be triggered when a user opens a crafted V7 project file, potentially expo
Opening a crafted V7 project file in Fuji Electric/Hakko V-SFT can cause an out-of-bounds read in VS6EditData!CDataRomEr
Opening a crafted V7 project file in Fuji Electric V-SFT can trigger an out-of-bounds read in the macro-command check pa
Out-of-bounds read in Fuji Electric V-SFT's VS6ComFile!load_gr_item routine can expose memory contents or enable arbitra
An out-of-bounds write in Fuji Electric's V-SFT screen-creation software (also published under Hakko Electronics) is tri
Stack-based buffer overflow in Fuji Electric/Hakko Electronics V-SFT versions through 6.2.10.0 enables arbitrary code ex
Stack-based buffer overflow in Fuji Electric/HAKKO Electronics V-SFT automation software (versions ≤6.2.10.0) allows arb
Out-of-bounds read in Fuji Electric V-SFT 6.2.10.0 and earlier allows local attackers to disclose sensitive information
Out-of-bounds read in Fuji Electric V-SFT 6.2.10.0 and earlier allows local attackers to extract sensitive memory conten
Out-of-bounds read in Fuji Electric V-SFT industrial HMI software (versions ≤6.2.10.0) enables local attackers to disclo
Access of uninitialized pointer vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' ver
Exploit-DB