An out‑of‑bounds read occurs in the get_macro_mem_COM function of V‑SFT, enabling a crafted V7 file to cause the program to read data beyond the intended buffer. This flaw, identified as CWE‑125, can expose sensitive information from memory, resulting in potential information disclosure that threatens confidentiality.

The affected product is Fujitsu Electric Co., Ltd. and Hakko Electronics Co., Ltd. V‑SFT software version 6.2.10.0 and all earlier releases. Any local or network installation of these versions that processes V7 files is vulnerable.

With a CVSS score of 8.4 the severity is high, but the EPSS score of less than 1 % indicates a low current exploitation probability and it is not listed in CISA’s KEV catalog. The likely attack vector is the local user or remote attacker who forces the application to open a malicious V7 file; if the application accepts files from external sources, a remote exploitation path exists. No public exploit is available, so ongoing monitoring of vendor advisories is recommended.