Technical impact
The vulnerability is an out-of-bounds read in the VS6ComFile!load_gr_item function of FUJI ELECTRIC CO., LTD.’s V‑SFT software. Opening a specially crafted V7 file can expose sensitive information or enable an attacker to execute arbitrary code. The flaw results from bounds checking failures that allow the program to read data beyond the intended buffer, directly matching CWE‑125.
Affected Systems
The affected product is V‑SFT from FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. Specific version information is not provided in the advisory, so all installations of V‑SFT that incorporate the VS6ComFile module should be considered vulnerable until a patch is released.
Risk and Exploitability
The CVSS score of 8.4 indicates high severity. No EPSS value is available, so the likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a malicious V7 file to the affected system, which may be local or delivered via removable media; the exact attack vector is not explicitly defined in the advisory, but the information read or code execution could be triggered by opening the file.
