Fuji Electric V-SFT: Out-of-bounds write when opening a crafted V7 file
Summary
Fuji Electric V-SFT, an engineering software for HMI screen design (co-distributed with Hakko Electronics), contains an out-of-bounds write vulnerability (CWE-787). An attacker who gets a user to open a specially crafted V7 file may be able to expose information or execute arbitrary code on the affected system. The attack requires local access to the file and user interaction, so it is not directly reachable over the network.
Affected
- V-SFT versions 0 up to and including 6.2.11.0
Fixed in
- V-SFT-6 Ver. V6.2.12.0 (per the vendor's improvement information No. 26A0H18; verify against the vendor advisory)
Workaround
- No vendor workaround known.
- Until patched: open V7 files only from trusted, known sources; scan or quarantine project files received by email or USB; keep V-SFT workstations away from general office networks and web browsing; use least-privilege accounts; back up project files.
Exploitation
- Not known to be exploited in the wild.
- Not listed in the CISA KEV catalog.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public proof-of-concept found at the time of research.
Our recommendation
- Inventory all V-SFT installations and their versions.
- Obtain the fixed release from the Fuji Electric advisory, not from third-party sites.
- Patch engineering workstations first, and apply the file-handling controls above until patching is complete.
- Monitor engineering workstations for abnormal activity and unauthorized file access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fuji Electric V-SFT-6 Ver. V6.2.12.0 improvement information felib.fujielectric.co.jp
- JVN JVNVU#96549652: Multiple vulnerabilities in FUJI ELECTRIC V-SFT jvn.jp
- VulDB CVE-2026-107895 vuldb.com
- OpenCVE CVE-2026-107895 app.opencve.io
- Strix CVE-2026-107895 www.strix.ai
- OffSeq radar CVE-2026-107895 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:03.
Original description (NVD)
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds write vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.