EUVD-2026-109624
GHSA-p6rw-32qg-27hg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious V7 file
-
DeliveryDeliver file to V-SFT operator
-
ExploitVictim opens file in V-SFT
-
ExecutionOverflow stack buffer in V7 parser
-
ImpactExecute arbitrary code or leak data on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted V7 file in Fuji Electric V-SFT (the HMI configuration/programming software); this is the exact trigger stated in the description. Limiting factors: the attack vector is local (AV:L) and demands active user interaction (UI:A) - the attacker cannot reach the vulnerability over a network and must socially engineer or otherwise induce a legitimate V-SFT user to open the malicious file. No authentication is required of the attacker (PR:N), and code executes with the privileges of the user running V-SFT. There is no indication the flaw affects default/idle operation absent the malicious-file-open action. |
| Impact | Signals are moderate and consistent rather than emergency-level. The authoritative CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) describes a local, low-complexity flaw that requires a victim to actively open a crafted V7 file, so this is a client-side/file-parsing issue, not a remotely reachable service bug - the 8.4 score is driven by high confidentiality, integrity and availability impact (VC:H/VI:H/VA:H) on the local system, not by remote reachability. The vuln.today decision label is 'this_week', which is a prioritize-but-not-drop-everything signal and is consistent with the UI-dependent local vector. No EPSS score, no CISA KEV listing, and no SSVC automatable/exploitation data were supplied, and the two references are vendor (Fuji Electric FeLib) and coordinator (JPCERT/JVN) advisories only - no proof-of-concept or exploit reference is present. Exploitation status is therefore 'no public exploit identified at time of analysis.' Net: a genuine high-severity code-execution bug worth patching on a near-term (this-week) cadence, but the local vector plus required user interaction materially limits real-world risk compared with a network-exploitable RCE, and the absence of EPSS/KEV/POC data means exploitation likelihood cannot be quantified from the input. |
| Exploit ScenarioDerived | An attacker crafts a malicious V7 project file and delivers it to an engineer or operator (e.g. via email, shared drive, or a compromised project repository); when the victim opens it in V-SFT, a stack-based buffer overflow is triggered, leading to information exposure or arbitrary code execution in the context of the user running V-SFT. Exploitation requires that targeted user to open the file (UI:A) and is local (AV:L); no public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Opening a crafted V7 project file in Fuji Electric V-SFT (the HMI screen-configuration and programming software, listed in the CPE as Fuji Electric / Hakko Electronics V-SFT) overflows a stack buffer and can result in information exposure or arbitrary code execution with the privileges of the user running the application. The attack is local rather than network-reachable and requires the victim to actively open the malicious file, so compromise depends on social engineering a legitimate V-SFT user; no authentication is required of the attacker. No public exploit code has been identified at time of analysis, and the vulnerability is tracked by JPCERT/CC under JVNVU96549652 with a priority of 'this_week' rather than emergency-level.
RemediationAI
No vendor-released patch is identified in the available data, and no fixed version number is given, so the first step is to consult the Fuji Electric product document (https://felib.fujielectric.co.jp/en/M10010/M20060/document_detail/5d9dd71d-9494-41a4-aa5c-8e6b8b21066b?region=en-glb) and JVN advisory JVNVU96549652 (https://jvn.jp/en/vu/JVNVU96549652/) for the vendor's stated fix or update and apply it as soon as it is published. Until then, the actionable control follows directly from the confirmed trigger: because exploitation requires a user to open a crafted V7 file, restrict V-SFT users to opening V7 project files received from verified, trusted sources and treat unsolicited or unknown V7 files as hostile, with the trade-off that this adds a manual verification step to engineering workflows and is a procedural, not technical, barrier. Because any code that does execute runs with the privileges of the user running V-SFT, running the application under a low-privilege account or in an isolated environment limits the blast radius of a successful open, at the cost of extra administration and possible friction with project file sharing. Updating to a vendor-fixed build, once one is listed in the referenced advisories, remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a stack-based buffer overflow (CWE-121) in the parsing path V-SFT uses when loading V7 project files, the native format for HMI screen and program data. A crafted V7 file supplies data that is written past the bounds of a fixed-size stack buffer, corrupting adjacent stack memory; depending on what is overwritten, the outcome ranges from disclosure of memory contents to control-flow hijacking and arbitrary code execution. The assessed CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and the provider's CVSS:4.0 vector agree that the attack vector is local, no privileges are required, user interaction is required, and the security scope is unchanged, so impact is confined to the process and account running V-SFT. The exact field or offset within the V7 file that triggers the overflow is not described in the available sources, and the CPE entry carries no version constraints, meaning the affected version range is not narrowed by the supplied data.
Know when V Sft gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
File must be opened locally in V-SFT so AV:L and UI:R; attacker needs no privileges (PR:N); crafted file reliably triggers the overflow (AC:L) with full local C/I/A impact.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
2DescriptionCVE.org
V-SFT provided by FUJI ELECTRIC CO., LTD. contains a stack-based buffer overflow vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
Executive ViewAI
A high-severity stack buffer overflow in Fuji Electric V-SFT, the HMI screen-configuration software used by engineering staff, could let a malicious project file expose sensitive information or execute arbitrary code with the privileges of the user who opens it. Because exploitation requires a legitimate user to open a crafted file, the practical risk is social engineering of engineering and operations personnel rather than remote attack, placing the burden on user behavior and file-handling practices. Leadership should care because affected staff typically hold elevated access to control-system configuration environments, and no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: open V-SFT project files only from verified trusted sources, screen inbound project files at email and file-transfer gateways, run V-SFT under non-administrative accounts with isolated workstations, and monitor for anomalous child processes spawned by V-SFT.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Out-of-bounds read in Fuji Electric V-SFT can be triggered when a user opens a crafted V7 project file, potentially expo
Opening a crafted V7 project file in Fuji Electric/Hakko V-SFT can cause an out-of-bounds read in VS6EditData!CDataRomEr
Opening a crafted V7 project file in Fuji Electric V-SFT can trigger an out-of-bounds read in the macro-command check pa
Opening a crafted V7 project file in Fuji Electric's V-SFT screen-creation/engineering software can drive an out-of-boun
Out-of-bounds read in Fuji Electric V-SFT's VS6ComFile!load_gr_item routine can expose memory contents or enable arbitra
An out-of-bounds write in Fuji Electric's V-SFT screen-creation software (also published under Hakko Electronics) is tri
Stack-based buffer overflow in Fuji Electric/Hakko Electronics V-SFT versions through 6.2.10.0 enables arbitrary code ex
Stack-based buffer overflow in Fuji Electric/HAKKO Electronics V-SFT automation software (versions ≤6.2.10.0) allows arb
Out-of-bounds read in Fuji Electric V-SFT 6.2.10.0 and earlier allows local attackers to disclose sensitive information
Out-of-bounds read in Fuji Electric V-SFT 6.2.10.0 and earlier allows local attackers to extract sensitive memory conten
Out-of-bounds read in Fuji Electric V-SFT industrial HMI software (versions ≤6.2.10.0) enables local attackers to disclo
Access of uninitialized pointer vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' ver
Exploit-DB