Fuji Electric V-SFT: Out-of-bounds read when opening crafted V7 file

Summary

FUJI ELECTRIC V-SFT, a programming and configuration tool for human machine interfaces, contains an out-of-bounds read vulnerability (CWE-125). An attacker who gets a user to open a specially crafted V7 file can cause information exposure or possibly arbitrary code execution on the engineering PC. The CVE record and JVN list different functions for this CVE (set_temp_type_default in VS6MemInIF versus CDataRomErrorCheck::MacroCommandCheck in VS6EditData), so the exact code location is not confirmed.

Affected

• V-SFT versions 0 to 6.2.11.0 (CVE record, JVN: V-SFT 6.2.11.0 and prior)
• Hakko Electronics branded copies are listed as affected as well

Fixed in

• V-SFT-6 Ver.V6.2.12.0 (vendor improvement information No 26A0H18, published October 2026)

Workaround

Unknown.

• Do not open V7 project files from untrusted sources
• Restrict who can open V7 project files until the update is applied

Exploitation

• No known exploitation (CISA SSVC: exploitation none, not automatable)
• No public exploit found at the time of review

Our recommendation

• Inventory all V-SFT installations and versions, including Hakko-branded copies
• Update V-SFT to Ver.V6.2.12.0 or later, based on the vendor advisory
• Until patched, do not open V7 files from unknown sources, such as email attachments, USB sticks or shared folders
• Keep engineering workstations separate from the office network and general internet browsing
• Check the CVSS scores against your own exposure; the local attack vector and user interaction make this a medium-to-high priority for installations on engineering PCs

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Fuji Electric: Improvement information V-SFT-6 Ver.V6.2.12.0 felib.fujielectric.co.jp
• JPCERT/CC JVNVU#96549652: Multiple vulnerabilities in FUJI ELECTRIC V-SFT jvn.jp
• VulDB entry for CVE-2026-107897 vuldb.com
• OpenCVE entry for CVE-2026-107897 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:04.