CVE-2026-32927
Out-of-Bounds Read in V-SFT VS6MemInIF Causes Data Disclosure
Publication date: 2026-04-01
Last updated on: 2026-04-07
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fujielectric | v-sft | to 6.2.10.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vendor FUJI ELECTRIC CO., LTD. has addressed this vulnerability in V-SFT version 6.2.11.0.
- Update V-SFT software to version 6.2.11.0 or later.
- Avoid opening untrusted or crafted V7 files that could trigger the vulnerability.
- Implement local access controls to limit who can open V7 files on affected systems.
How can this vulnerability impact me? :
Exploiting this vulnerability can lead to information disclosure, meaning that an attacker could gain access to sensitive data from the affected product. The CVSS scores indicate a high severity with impacts on confidentiality, integrity, and availability, suggesting that the vulnerability could allow unauthorized information access and potentially disrupt normal operations.
Can you explain this vulnerability to me?
This vulnerability exists in V-SFT versions 6.2.10.0 and earlier. It is an out-of-bounds read issue found in the function VS6MemInIF!set_temp_type_default. When a specially crafted V7 file is opened, this flaw may cause the software to read memory outside the intended boundaries, potentially leading to the disclosure of sensitive information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects V-SFT versions 6.2.10.0 and prior when opening a crafted V7 file, leading to information disclosure. Detection involves identifying if the vulnerable version of V-SFT software is present on your system.
Since the vulnerability is triggered by opening a crafted V7 file, monitoring or scanning for such files being opened or transferred locally could help detect exploitation attempts.
No specific detection commands or network signatures are provided in the available information.