Technical impact
V‑SFT contains a buffer overflow that allows a crafted V7 file to corrupt memory, exposing confidential data or enabling arbitrary code execution with the privileges of the product. The weakness is a classic out‑of‑bounds write (CWE‑787).
Affected Systems
The vulnerability is present in the V‑SFT software supplied by FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. No sub‑versions are enumerated, so all releases that incorporate the vulnerable logic are potentially affected.
Risk and Exploitability
With a CVSS score of 8.4 the vulnerability is high severity. The EPSS score is not available, so the current exploitation probability is unknown, and the issue is not listed in the CISA KEV catalog. The description indicates that a malicious V7 file must be opened by the software; thus the likely attack vector is a local user or compromised user‑at‑session feeding a crafted file. If the vulnerability is triggered, an attacker could execute arbitrary code with the product’s privileges, leading to full compromise of the affected system.
