V-SFT includes an out-of-bounds read error in the VS6ComFile!CCheck::ItemCheck routine, which may expose sensitive data or allow arbitrary code execution if a malicious V7 file is processed. The flaw is a classic buffer boundary violation that can leak memory contents or provide a foothold for code execution, potentially compromising the confidentiality, integrity, or availability of the affected system.

The vulnerability affects the V-SFT product supplied by FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. No specific product versions are listed in the advisory, so all current releases of V‑SFT that include this code path are potentially impacted.

The CVSS score is 8.4, indicating a high severity. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a V7 file that triggers the out‑of‑bounds read and potentially leads to code execution when the file is opened on the victim’s system. The attack vector is likely local or file‑based, requiring the victim to open or process the malicious file.