FUJI ELECTRIC V-SFT: JVN discloses seven flaws in 6.2.11.0 and prior

What happened

On 2026-10-26, JVN published advisory JVNVU#96549652. It says FUJI ELECTRIC CO., LTD.’s V-SFT contains multiple vulnerabilities (JVN). According to JVN, the issues are:

• a stack-based buffer overflow (CWE-121), CVE-2026-107894
• an out-of-bounds write (CWE-787), CVE-2026-107895
• five out-of-bounds reads (CWE-125):
  • VS6ComFile!load_gr_item, CVE-2026-107896
  • VS6MemInIF!set_temp_type_default, CVE-2026-107897
  • VS6EditData!CDataRomErrorCheck::MacroCommandCheck, CVE-2026-107898
  • VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam, CVE-2026-107899
  • VS6ComFile!CCheck::ItemCheck, CVE-2026-107900

JVN lists each issue with a CVSS 4.0 base score of 8.4 and a CVSS 3.1 base score of 7.8. The vectors are local attack with user interaction required (JVN).

JVN says opening a specially crafted V7 file may lead to information exposure or arbitrary code execution on the affected product (JVN). JVN credits Michael Heinzl with reporting the flaws to JPCERT/CC, which coordinated with the developer (JVN).

JVN does not report exploitation, so active exploitation is not confirmed. JVN does not give technical exploit details or a timeline beyond the publication date.

Am I affected?

According to JVN, V-SFT ver 6.2.11.0 and prior are affected (JVN). Exposure depends on someone opening a crafted V7 file in the affected software (JVN).

JVN’s vendor status points to FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. improvement information for V-SFT-6 Ver.V6.2.12.0 No 26A0H18 (JVN).

What to do now

1. Check the installed V-SFT version on every workstation that uses it. Treat 6.2.11.0 and earlier as affected (JVN).
2. Apply the patch according to the developer’s information, which JVN references as V-SFT-6 Ver.V6.2.12.0 (JVN).
3. Until patched, avoid opening V7 files from untrusted or unverified sources. JVN identifies crafted V7 files as the trigger (JVN).

Sources

• JVN: JVNVU#96549652 Multiple vulnerabilities in FUJI ELECTRIC V-SFT (October 2026)