An out‑of‑bounds read occurs in the VS6MemInIF!set_temp_type_default function of V‑SFT firmware versions 6.2.10.0 and earlier when a maliciously crafted V7 file is opened. The flaw allows an attacker to read memory outside the intended buffer boundaries, potentially exposing sensitive data stored in memory, such as passwords or configuration information. This vulnerability is classified as CWE‑125 and results in information disclosure to the user or attacker who can craft and load the file.

Affected systems are Fujielectric and Hakko Electronics equipment running the V‑SFT application, specifically firmware versions 6.2.10.0 and any earlier releases. All units that use the legacy V‑SFT interface and process V7 files are at risk until the firmware is updated.

The CVSS base score for this flaw is 8.4, indicating high severity, while the EPSS score is below 1 %, suggesting that exploitation is considered unlikely at present. The vulnerability is not listed in the CISA KEV catalog, and no remote code execution vector is reported. However, an attacker can gain access to confidential data by tricking a user into opening a malicious V7 file; the attack requires user interaction and may be mitigated by applying the vendor patch or rejecting untrusted files.