CVE-2026-32926
Out-of-Bounds Read in V-SFT VS6ComFile Causes Data Disclosure
Publication date: 2026-04-01
Last updated on: 2026-04-07
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fujielectric | v-sft | to 6.2.10.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in V-SFT versions 6.2.10.0 and earlier. It is an out-of-bounds read issue in the function VS6ComFile!load_link_inf. When a specially crafted V7 file is opened, this flaw can cause the software to read memory outside the intended boundaries, potentially leading to the disclosure of sensitive information from the affected product.
How can this vulnerability impact me? :
Exploiting this vulnerability can lead to information disclosure, meaning that an attacker could gain access to sensitive data stored or processed by the affected product. The CVSS scores indicate a high impact on confidentiality, integrity, and availability, suggesting that the vulnerability could severely compromise the security of the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows information disclosure through an out-of-bounds read when opening a crafted file, which could lead to unauthorized access to sensitive data.
Such unauthorized information disclosure may impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users should update the V-SFT software to version 6.2.11.0 or later, as this version addresses the out-of-bounds read and related vulnerabilities.
Avoid opening crafted V7 files with vulnerable versions (6.2.10.0 and prior) to prevent potential information disclosure or arbitrary code execution.