V-SFT: Out-of-bounds read in CheckSymbolMacroParam when opening V7 files
Summary
V-SFT, the HMI screen-creation software from Fuji Electric and Hakko Electronics, contains an out-of-bounds read in the VS6EditData component (CDataRomErrorCheck::CheckSymbolMacroParam). An attacker can exploit it by tricking a user into opening a specially crafted V7 file, which may expose information or lead to arbitrary code execution on the engineering workstation. No network access is required, but user interaction is needed. The CVSS score is disputed across sources, so the vector should be used for prioritisation.
Affected
- V-SFT versions 0 up to and including 6.2.11.0
Fixed in
- Vendor improvement information for V-SFT-6 Ver. 6.2.12.0 (No. 26A0H18) is referenced by JVN. Verify the fixed release on the vendor page before rollout.
Workaround
Unknown. The CVE record and vendor page provide no workaround. Interim measure: avoid opening untrusted or unexpected V7 files in affected versions.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no.
- No public proof of concept found.
Our recommendation
- Check whether V-SFT is in use and which exact version is installed.
- Update to the fixed release named in the vendor advisory once verified.
- Until patched, accept V7 project files only from trusted sources and scan or quarantine them before opening.
- Run engineering workstations with least privilege and keep them away from general web browsing and email.
- Monitor the vendor advisory, JVN and the NVD/CISA KEV status for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fuji Electric: Improvement information V-SFT-6 Ver. V6.2.12.0 felib.fujielectric.co.jp
- JVN: JVNVU#96549652 Multiple vulnerabilities in FUJI ELECTRIC V-SFT jvn.jp
- OpenCVE: CVE-2026-107899 app.opencve.io
- OffSeq Radar: CVE-2026-107899 radar.offseq.com
- Strix AI: CVE-2026-107899 www.strix.ai
- VulDB: CVE-2026-107899 score entry vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:01.
Original description (NVD)
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.