V-SFT CVE-2026-107899

Exploitation requires a user to open a specially crafted V7 file inside Fuji Electric/Hakko V-SFT (UI:A, local vector AV:L) - there is no remote or unauthenticated network path. No special product configuration is named in the description beyond the file-parsing code path in CDataRomErrorCheck::CheckSymbolMacroParam; the precise trigger within the V7 file structure is not described in the available sources. Limiting factors: the attacker must socially engineer or otherwise deliver the malicious file to an operator, and the victim must actively open it; no privileges or authentication are required once the file is opened (PR:N), and code execution occurs in the context of the user running V-SFT.

This is a genuine but not emergency-grade priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) describes a local, file-driven vulnerability that requires the victim to actively open a crafted V7 file - it is NOT remotely exploitable against a network-facing service, despite the high 8.4 score. The high score is driven by the triple high impact (VC:H/VI:H/VA:H), consistent with the description's claim of possible information exposure or arbitrary code execution. Exploitation status: no public exploit identified at time of analysis (the two references are a Fuji Electric advisory and a JVN entry, not PoC/exploit code). No EPSS score was supplied and the CVE is not in CISA KEV, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with the signals: high technical impact but attacker-controlled delivery is gated behind required user interaction. In short, this is a credible client-side RCE in ICS engineering software that warrants prompt patching of affected workstations, but the local vector plus mandatory user interaction make mass or automated exploitation unlikely; realistic risk is targeted social-engineering of engineers.

An attacker crafts a malicious V7 project file and delivers it to a control-systems engineer (e.g. via email, shared drive, or a compromised project repository). When the engineer opens the file in V-SFT, the out-of-bounds read in CDataRomErrorCheck::CheckSymbolMacroParam is triggered, potentially leaking process memory or executing arbitrary code in the context of the user. No public exploit code is currently known, and exploitation requires the victim to open the attacker-supplied file (UI:A).