Fuji Electric V-SFT: Stack-based buffer overflow when opening V7 file
Summary
A stack-based buffer overflow (CWE-121) in V-SFT, engineering software for Monitouch HMI screens, affects versions 6.2.11.0 and earlier. An attacker who gets a user to open a specially crafted V7 file may expose information or execute arbitrary code on the affected system. The attack is local and requires user interaction, so the main risk lies with engineering workstations. The NVD record is in Deferred status, and the CVSS 4.0 base score is 8.4.
Affected
- V-SFT (FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd.) version 6.2.11.0 and prior
- Default configuration: unaffected according to the CNA record
Fixed in
- Vendor improvement information for V-SFT-6 Ver. V6.2.12.0 (No. 26A0H18), referenced by JVN and published by the vendor in October 2026
- The vendor advisory was not independently verified; check it before deployment
Workaround
- Unknown. The vendor has not published a specific workaround in the sources reviewed.
- Open V7 project files only from trusted sources.
- Restrict who can write or open project files on engineering workstations.
Exploitation
- CISA SSVC: exploitation none, not automatable
- Not listed in CISA KEV
- OffSeq reports no known exploitation
- No public proof of concept found
Our recommendation
- Inventory all V-SFT installations and their versions.
- Update V-SFT to Ver. V6.2.12.0 or later after verifying the vendor advisory.
- Until patched, open V7 files only from trusted sources and keep V-SFT off internet-facing hosts.
- Restrict file access and admin rights on engineering workstations and monitor them for unusual activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fuji Electric: Improvement information V-SFT-6 Ver.V6.2.12.0 felib.fujielectric.co.jp
- JVN: JVNVU#96549652 Multiple vulnerabilities in FUJI ELECTRIC V-SFT jvn.jp
- VulDB: CVE-2026-107894 vuldb.com
- OpenCVE: CVE-2026-107894 app.opencve.io
- OffSeq Radar: CVE-2026-107894 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:02.
Original description (NVD)
V-SFT provided by FUJI ELECTRIC CO., LTD. contains a stack-based buffer overflow vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.