Technical impact
V‑SFT, the firmware editing solution from FUJI ELECTRIC CO., LTD. and Hakko Electronics, contains an out‑of‑bounds read in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. When a specially crafted V7 file is opened, the routine can read data beyond the intended buffer, which may expose internal information or allow an attacker to execute arbitrary code.
Affected Systems
The vulnerability is present in V‑SFT products distributed by FUJI ELECTRIC CO., LTD. and Hakko Electronics. All versions that support parsing the V7 file format are potentially affected. No specific affected version ranges are listed, so the risk applies to all pre‑patch installations.
Risk and Exploitability
Based on the description, it is inferred that the attack vector requires an attacker to supply a specially crafted V7 file to the product. The vulnerability carries a CVSS score of 8.4, classifying it as high severity. EPSS is not available, and the entry is not included in the CISA KEV list, suggesting that documented exploits are not currently known. The flaw is triggered by opening a crafted V7 file, meaning that an attacker must place the file on a system that will load it, either by user interaction or by compromising file‑handling processes. If the out‑of‑bounds read succeeds, the attacker could gain access to sensitive internal data or achieve arbitrary code execution, presenting a significant risk for environments that process untrusted files.
