EUVD-2026-109630
GHSA-rmxf-8677-77h7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted V7 file to operator
-
ExploitOperator opens file in V-SFT
-
ExecutionTrigger out-of-bounds read in ItemCheck
-
ImpactExecute code or disclose process memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to open a specially crafted V7 project file within Fuji Electric V-SFT; per the CVSS vector UI:A (active interaction) this victim action is mandatory and is the primary limiting factor. The vector is local (AV:L) - there is no remote or network-triggered path - and no authentication or prior privileges are needed (PR:N), so any user who can be socially engineered into opening an attacker-supplied V7 file is at risk. There is no indication of a non-default configuration requirement; the condition is simply that the vulnerable V-SFT software processes the malicious file. |
| Impact | This is a moderate-priority, not emergency, issue. The input CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H, score 8.4) describes a local, low-complexity flaw with no privileges required but active user interaction mandatory - meaning a victim must open a malicious file. This is consistent with the description (opening a crafted V7 file), so the signals do not conflict: the high 8.4 score is driven by the full compromise of confidentiality, integrity, and availability (potential arbitrary code execution), NOT by remote reachability. The vuln.today Decision label is 'this_week', which indicates prioritization above routine but below act_now/emergency. No EPSS score was provided, no CISA KEV listing is present (exploitation not confirmed active), and no public exploit or PoC reference appears in the supplied data - only the Fuji Electric advisory and the JPCERT/JVN coordination entry. Net assessment: a genuine high-severity bug worth patching promptly, but real-world risk is bounded by the requirement for operator interaction (file opening) and local vector rather than mass remote exploitation. |
| Exploit ScenarioDerived | An attacker crafts a malicious V7 project file and delivers it to an engineer or operator (e.g. via email, shared drive, or a spoofed project handoff). When the victim opens the file in Fuji Electric V-SFT, the out-of-bounds read in VS6ComFile!CCheck::ItemCheck is triggered, leaking process memory or, in the worst case, achieving arbitrary code execution on the engineering workstation. No public exploit code was identified in the provided sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Out-of-bounds read in Fuji Electric V-SFT can be triggered when a user opens a crafted V7 project file, potentially exposing information or enabling arbitrary code execution on the affected system. The flaw is local and requires user interaction-the victim must open the malicious file-and no privileges are required, so social engineering is the primary attack vector. This is a moderate-priority, not emergency, issue; no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis; check the Fuji Electric advisory at https://felib.fujielectric.co.jp/en/M10010/M20060/document_detail/5d9dd71d-9494-41a4-aa5c-8e6b8b21066b?region=en-glb and the JVN advisory at https://jvn.jp/en/vu/JVNVU96549652/ for updated versions and install the vendor's fixed release when published. Until then, because exploitation requires a user to open a crafted V7 file, restrict V-SFT users from opening V7 project files from untrusted or unexpected sources and quarantine or scan such files before use; this can disrupt workflows that depend on receiving third-party project files. Where third-party V7 files must be handled, do so on isolated or low-privilege systems to limit the impact of code execution; this adds operational overhead and does not eliminate the parsing flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-107900 is an out-of-bounds read (CWE-125) in the VS6ComFile!CCheck::ItemCheck component of Fuji Electric V-SFT, a software product associated with Fuji Electric and Hakko Electronics operator-interface engineering. The weakness is reached while the product processes a crafted V7 project file, but the supplied sources do not describe the exact parsing path or the malformed field that causes the read beyond the intended buffer. Because the flaw is an out-of-bounds read, the advisory impact includes possible information exposure, and it also warns of possible arbitrary code execution. The CVSS 4.0 vector is local (AV:L) with active user interaction (UI:A) and no privileges required (PR:N), matching the assessed requirement that a victim open the malicious V7 file.
Know when V Sft gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
File-parsing flaw triggered locally by the victim opening a crafted V7 file, so AV:L and UI:R with PR:N; out-of-bounds read enabling code execution yields high C/I/A.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
2DescriptionCVE.org
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
Executive ViewAI
Fuji Electric V-SFT, an engineering tool used to configure industrial control systems, contains a high-severity flaw that could allow an attacker to execute code or access sensitive information when a user opens a malicious project file. This puts engineering workstations at risk, potentially leading to unauthorized actions within industrial environments, but exploitation requires user interaction and no public exploit code has been identified. Leadership should prioritize patching to prevent potential operational disruptions or data breaches.
No vendor-released patch identified at time of analysis. Interim mitigations include user awareness training on file handling, restricting opening of project files to trusted sources, and deploying endpoint detection and response solutions to monitor for suspicious file activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Opening a crafted V7 project file in Fuji Electric V-SFT (the HMI screen-configuration and programming software, listed
Opening a crafted V7 project file in Fuji Electric/Hakko V-SFT can cause an out-of-bounds read in VS6EditData!CDataRomEr
Opening a crafted V7 project file in Fuji Electric V-SFT can trigger an out-of-bounds read in the macro-command check pa
Opening a crafted V7 project file in Fuji Electric's V-SFT screen-creation/engineering software can drive an out-of-boun
Out-of-bounds read in Fuji Electric V-SFT's VS6ComFile!load_gr_item routine can expose memory contents or enable arbitra
An out-of-bounds write in Fuji Electric's V-SFT screen-creation software (also published under Hakko Electronics) is tri
Stack-based buffer overflow in Fuji Electric/Hakko Electronics V-SFT versions through 6.2.10.0 enables arbitrary code ex
Stack-based buffer overflow in Fuji Electric/HAKKO Electronics V-SFT automation software (versions ≤6.2.10.0) allows arb
Out-of-bounds read in Fuji Electric V-SFT 6.2.10.0 and earlier allows local attackers to disclose sensitive information
Out-of-bounds read in Fuji Electric V-SFT 6.2.10.0 and earlier allows local attackers to extract sensitive memory conten
Out-of-bounds read in Fuji Electric V-SFT industrial HMI software (versions ≤6.2.10.0) enables local attackers to disclo
Access of uninitialized pointer vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' ver
Exploit-DB