Fuji Electric
Monthly
Use-after-free memory corruption in Fuji Electric's Monitouch V-SFT engineering software (v6.2.7.0 and earlier) allows an attacker to trigger information disclosure, abnormal application termination (ABEND), or arbitrary code execution when a specially crafted V-SFT project/configuration file is opened in the affected application. The flaw lies in the VS6ComFile!load_link_inf routine reached during file parsing; the attack vector is local and requires the victim to open a malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, vendor score 8.4), so exploitation depends on social-engineering or supply-chain delivery of a crafted project file rather than a network-exposed trigger. EPSS is low at 0.17% (6th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Out-of-bounds write in Fuji Electric V-SFT 6.2.7.0 and earlier can let a crafted V-SFT project file cause information disclosure, abnormal termination (ABEND), or arbitrary code execution when a user opens it. The flaw is in the VS6ComFile!CItemDraw::is_motion_tween drawing-item parsing path; the assessed CVSS 3.1 vector is local with user interaction (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so exploitation depends on social engineering to deliver a malicious .V8/.V9 project file to a vulnerable engineering workstation rather than remote network access. No public exploit identified at time of analysis; EPSS is 0.18% (7th percentile), CISA KEV does not list this CVE, and the overall signals point to a moderate, non-urgent priority despite the 8.4 CVSS 4.0 score.
Out-of-bounds write in Fuji Electric's MONITOUCH V-SFT HMI configuration tool (v6.2.7.0 and earlier) allows an attacker who convinces a user to open a specially crafted V-SFT project file to corrupt memory and achieve information disclosure, abnormal termination (ABEND) of the application, or arbitrary code execution in the context of the victim user. Per the CVSS vector the flaw requires no authentication (PR:N) but is a local/client-side issue (AV:L) gated by user interaction (UI:A), so exploitation depends on social engineering rather than any network-reachable service. Exploitation status: no public exploit identified at time of analysis, and EPSS is very low at 0.18% (7th percentile), indicating limited expected opportunistic activity; the vendor-accepted CVSS 4.0 score is 8.4, and the independent assessment rates the same issue as CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Use-after-free memory corruption in Fuji Electric's Monitouch V-SFT engineering software (v6.2.7.0 and earlier) allows an attacker to trigger information disclosure, abnormal application termination (ABEND), or arbitrary code execution when a specially crafted V-SFT project/configuration file is opened in the affected application. The flaw lies in the VS6ComFile!load_link_inf routine reached during file parsing; the attack vector is local and requires the victim to open a malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, vendor score 8.4), so exploitation depends on social-engineering or supply-chain delivery of a crafted project file rather than a network-exposed trigger. EPSS is low at 0.17% (6th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Out-of-bounds write in Fuji Electric V-SFT 6.2.7.0 and earlier can let a crafted V-SFT project file cause information disclosure, abnormal termination (ABEND), or arbitrary code execution when a user opens it. The flaw is in the VS6ComFile!CItemDraw::is_motion_tween drawing-item parsing path; the assessed CVSS 3.1 vector is local with user interaction (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so exploitation depends on social engineering to deliver a malicious .V8/.V9 project file to a vulnerable engineering workstation rather than remote network access. No public exploit identified at time of analysis; EPSS is 0.18% (7th percentile), CISA KEV does not list this CVE, and the overall signals point to a moderate, non-urgent priority despite the 8.4 CVSS 4.0 score.
Out-of-bounds write in Fuji Electric's MONITOUCH V-SFT HMI configuration tool (v6.2.7.0 and earlier) allows an attacker who convinces a user to open a specially crafted V-SFT project file to corrupt memory and achieve information disclosure, abnormal termination (ABEND) of the application, or arbitrary code execution in the context of the victim user. Per the CVSS vector the flaw requires no authentication (PR:N) but is a local/client-side issue (AV:L) gated by user interaction (UI:A), so exploitation depends on social engineering rather than any network-reachable service. Exploitation status: no public exploit identified at time of analysis, and EPSS is very low at 0.18% (7th percentile), indicating limited expected opportunistic activity; the vendor-accepted CVSS 4.0 score is 8.4, and the independent assessment rates the same issue as CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.