V-SFT, distributed by FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd., contains a stack‑based buffer overflow. When a specially crafted V7 file is opened, the vulnerability can leak sensitive data or allow an attacker to execute arbitrary code. The weakness is classified as CWE‑121, a classic buffer overflow that corrupts the control flow of the application.

Products affected are the V‑SFT software from FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. The current data set does not specify exact version numbers, so any installed instance that processes V7 files is potentially vulnerable.

The CVSS score of 8.4 views the issue as high severity. While EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog, the lack of exploitation data does not diminish the risk of local exploitation. Because the flaw is triggered by a crafted file, an attacker must supply a malicious V7 file, which implies a privileged or local attack vector or a user‑initiated file import. Proper input validation and patching are essential to mitigate the exploitation risk.