A stack-based buffer overflow occurs in the function _conv_AnimationItem within V‑SFT versions 6.2.10.0 and earlier. When a user opens a specially crafted V7 file, the overflow can trigger execution of arbitrary code running in the same context as the affected firmware. This flaw grants an attacker potential control over the device’s data, possibly allowing unauthorized modification or extraction of data and may facilitate further attacks on connected systems.

The vulnerability affects V‑SFT products from Fuji Electric Co., Ltd. and Hakko Electronics Co., Ltd. specifically the V‑SFT software versions 6.2.10.0 and earlier. No later versions are listed as affected in the current advisory.

The CVSS score of 8.4 indicates a high severity with a large impact on confidentiality, integrity, and availability. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation would require an attacker to deliver a crafted V7 file to the target, implying a local or remote user that can trigger file processing. If an attacker gains the necessary privilege, they could execute malicious code on the device.