Executive Summary

This vulnerability exists in V-SFT versions 6.2.10.0 and earlier. It is an out-of-bounds read issue in the function VS6ComFile!load_link_inf. When a specially crafted V7 file is opened, this flaw can cause the software to read memory outside the intended boundaries, potentially leading to the disclosure of sensitive information from the affected product.

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability can lead to information disclosure, meaning that an attacker could gain access to sensitive data stored or processed by the affected product. The CVSS scores indicate a high impact on confidentiality, integrity, and availability, suggesting that the vulnerability could severely compromise the security of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows information disclosure through an out-of-bounds read when opening a crafted file, which could lead to unauthorized access to sensitive data.

Such unauthorized information disclosure may impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, users should update the V-SFT software to version 6.2.11.0 or later, as this version addresses the out-of-bounds read and related vulnerabilities.

Avoid opening crafted V7 files with vulnerable versions (6.2.10.0 and prior) to prevent potential information disclosure or arbitrary code execution.

Useful 0 Not Useful 0