V-SFT: Out-of-bounds read when opening a crafted V7 file
Summary
V-SFT, the engineering software from FUJI ELECTRIC and Hakko Electronics for Fuji HMI projects, contains an out-of-bounds read in the VS6ComFile module (load_gr_item). Opening a specially crafted V7 file can expose information or lead to arbitrary code execution on the engineering workstation. The attacker needs a user to open the malicious file, so phishing, shared project files or supplier files are the realistic attack path. No remote network exposure is indicated.
Affected
- V-SFT (V-SFT-6) up to and including 6.2.11.0 according to the CVE record and JVN
- Affected range per CNA: 0 to 6.2.11.0
Fixed in
- V-SFT-6 Ver. V6.2.12.0 (vendor improvement information No. 26A0H18, published October 2026)
Workaround
- No vendor-confirmed workaround.
- Open V7 project files only from trusted sources; treat files from suppliers, email and USB as untrusted.
- Run V-SFT on dedicated engineering workstations without browsing or email, and with standard user rights.
- Segment the engineering network and back up project files before updating.
Exploitation
- No known exploitation in the wild; not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- VulDB reports no public exploit; no public proof of concept was found.
Our recommendation
- Inventory all V-SFT installations and their versions.
- Update every V-SFT installation at or below 6.2.11.0 to V6.2.12.0 or later, as published by the vendor.
- Until patched, do not open untrusted V7 files on engineering workstations.
- Monitor the vendor advisory and NVD/CISA KEV for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fuji Electric: Improvement information V-SFT-6 Ver. V6.2.12.0 felib.fujielectric.co.jp
- JPCERT/CC JVNVU#96549652: Multiple vulnerabilities in FUJI ELECTRIC V-SFT jvn.jp
- VulDB CVE-2026-107896 vuldb.com
- OpenCVE CVE-2026-107896 app.opencve.io
- VulDB vulnerability 426324 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:03.
Original description (NVD)
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.