The vulnerability is an out‑of‑bounds read in the VS6ComFile!load_link_inf routine. When a crafted V7 file is processed, the function may read data from memory locations beyond the intended buffer, allowing an attacker to obtain sensitive information stored elsewhere. The exploit does not provide code execution; it is limited to leaking data that the system can read.

Fuji Electric and Hakko Electronics’ V‑SFT product, specifically versions 6.2.10.0 and earlier. No other versions are listed as affected, and the issue is confined to these software releases.

The CVSS score of 8.4 indicates a high severity vulnerability. With an EPSS score below 1 % and no listing in CISA’s KEV catalog, current exploitation activity is likely low, but the impact remains significant for any user who opens a malicious V7 file. The attack vector is inferred to be local or controlled, as the victim must open or trigger processing of a crafted file. Preventing exposure of such files or updating to newer versions mitigates the risk.