Fuji Electric V-SFT: Out-of-bounds read when opening crafted V7 file
Summary
Fuji Electric V-SFT up to version 6.2.11.0 contains an out-of-bounds read in the V7 file check (VS6ComFile, CCheck::ItemCheck). If a user opens a specially crafted V7 file, an attacker may expose information or, according to the vendor-related description, execute arbitrary code on the affected system. The sources report local file-based attack paths only and no internet exposure.
Affected
- V-SFT 0 to 6.2.11.0 (CVE record and JVN)
Fixed in
- Vendor improvement information for V-SFT-6 Ver. 6.2.12.0 (No. 26A0H18), published October 2026. The vendor advisory must confirm that this release fixes CVE-2026-107900.
Workaround
- No vendor workaround known.
- Open V7 project files only from trusted sources.
- Keep V-SFT off general-purpose PCs and email clients.
- Restrict who can install or run V-SFT.
- Use application allow-listing and log file-opening activity on engineering workstations.
- These interim measures are recommendations, not vendor statements.
Exploitation
- CISA SSVC: exploitation none, not automatable.
- Not listed in CISA KEV.
- VulDB: no exploit available. EPSS 0.00127.
- No public proof-of-concept found.
Our recommendation
- Identify all systems running V-SFT 6.2.11.0 or earlier.
- Obtain V-SFT 6.2.12.0 or later from Fuji Electric or your integrator and plan the update after confirming the fix in the vendor advisory.
- Until patched, apply the interim measures and open project files only from trusted sources.
- Check whether the same fix covers sibling CVEs CVE-2026-107894 to CVE-2026-107899.
- Priority: moderate; higher on engineering laptops that also handle email or external project files.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fuji Electric advisory (V-SFT-6 Ver. 6.2.12.0) felib.fujielectric.co.jp
- JVN JVNVU#96549652 jvn.jp
- VulDB CVE-2026-107900 vuldb.com
- VulDB 426329 vuldb.com
- CNNVD mirror via Vulners vulners.com
- OpenCVE CVE-2026-107900 app.opencve.io
- OffSeq CVE-2026-107900 radar.offseq.com
- Strix CVE-2026-107900 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:01.
Original description (NVD)
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.