Fuji Electric V-SFT CVE-2026-107898

Exploitation requires a user to open an attacker-crafted V7 file in Fuji Electric V-SFT; the vulnerable path is the macro-command check in CDataRomErrorCheck::MacroCommandCheck during file parsing. The CVSS vector confirms this is local with required active user interaction (AV:L/UI:A/PR:N) - there is no network vector and no authentication is needed by the attacker, but the attack cannot proceed without the victim opening the malicious file on a host where V-SFT is installed. Limiting factors: the attacker must first deliver the file and socially engineer the victim into opening it, and impact is confined to the engineering workstation running V-SFT rather than any remotely exposed service.

Signals are moderate and consistent rather than alarming. The CVSS 4.0 base score of 8.4 (High) is driven by high confidentiality, integrity and availability impact (VC:H/VI:H/VA:H), but the vector is local with active user interaction (AV:L/AC:L/PR:N/UI:A): this is a client-side file-parsing flaw, not a remotely reachable service bug. An attacker cannot trigger it over the network; a user must open a crafted V7 file in V-SFT. Exploitation status is 'no public exploit identified at time of analysis' - the two references are the Fuji Electric vendor advisory and the JVN/JPCERT coordination note, neither of which is PoC or exploit code. The vuln.today decision label is 'this_week', i.e. prioritized but below act_now/emergency. KEV status is not listed (no CISA KEV entry) and no EPSS score is provided in the input, so widespread-exploitation probability cannot be quantified from the data. Net: a genuine high-severity memory-safety issue in OT engineering software warranting patching this week, but the local/user-interaction requirement and absence of KEV, EPSS and public PoC mean it is not a drop-everything emergency.

An attacker crafts a malicious V7 project file and delivers it to an engineer or integrator (via email, shared project repository, USB, or a compromised supplier handoff). When the victim opens the file in V-SFT, the out-of-bounds read in CDataRomErrorCheck::MacroCommandCheck is triggered, leaking process memory or, in the worst case, achieving arbitrary code execution on the engineering workstation. No public exploit code is identified at time of analysis, and the local vector with required user interaction (AV:L/UI:A) means the attack hinges on social engineering the victim into opening the file.