Technical impact
The V‑SFT application from Fujielectric has an out‑of‑bounds read bug in the CheckSymbolMacroParam function. When a maliciously crafted V7 file is processed, the program reads memory beyond the intended buffer, which can expose sensitive data or, under certain conditions, allow the attacker to execute code. The flaw originates from improper bounds checking, classified as CWE‑125.
Affected Systems
The affected product is the V‑SFT suite supplied by FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. The vulnerability exists in the VS6EditData component of V‑SFT. No specific version numbers are listed in the available data; administrators should verify whether their deployed V‑SFT instances include the CheckSymbolMacroParam logic, especially those that actively process V7 files.
Risk and Exploitability
The CVSS score is 8.4, indicating high severity. An EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the vulnerability is triggered by opening a crafted V7 file, an attacker would typically need to supply that file to the target system via social engineering, intranet file transfer, or any service that imports V7 data. The exploit can lead to information disclosure or arbitrary code execution on the affected product.
