Technical impact
FUJI ELECTRIC CO., LTD. and Hakko Electronics publish a V-SFT product that contains an out‑of‑bounds read flaw in the VS6MemInIF!set_temp_type_default function. The vulnerability allows an attacker to trigger a memory read beyond the allocated buffer by opening a crafted V7 file, which may leak sensitive data and, according to the vendor description, can also lead to arbitrary code execution. The weakness is a classic buffer read error (CWE‑125).
Affected Systems
The affected product is the V‑SFT software suite, distributed by Fujielectric and Hakko Electronics. No specific firmware or version numbers are listed in the advisories, so any installation of this software that currently presents the V‑SFT module is potentially vulnerable.
Risk and Exploitability
The CVSS score of 8.4 indicates a high severity level. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires a malicious V7 file to be processed by the V‑SFT application, so the attack vector is inferred to be a local file‑based attack (or remote if the software processes files unattended). If the flaw is triggered, the attacker could acquire confidential memory contents and may be able to execute code in the context of the V‑SFT process.
