CVE-2026-32929
Out-of-Bounds Read in V-SFT VS6ComFile Causes Data Disclosure
Publication date: 2026-04-01
Last updated on: 2026-04-07
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fujielectric | v-sft | to 6.2.10.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in V-SFT versions 6.2.10.0 and earlier, where an out-of-bounds read occurs in the function VS6ComFile!get_macro_mem_COM. This means that when a specially crafted V7 file is opened, the software may read memory outside the intended boundaries, potentially exposing sensitive information.
How can this vulnerability impact me? :
The impact of this vulnerability is information disclosure. An attacker who provides a crafted V7 file to the affected product could cause it to read and reveal sensitive information from memory that should not be accessible. This could lead to exposure of confidential data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in V-SFT versions 6.2.10.0 and prior involves an out-of-bounds read that may lead to information disclosure when opening a crafted V7 file.
Such information disclosure vulnerabilities can potentially impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding sensitive information against unauthorized access or leaks.
However, specific details on how this vulnerability affects compliance with these standards are not provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the FUJI Electric V-SFT software to version 6.2.11.0 or later, as this version addresses the out-of-bounds read and related vulnerabilities.
Avoid opening crafted V7 files from untrusted sources, as exploitation involves opening such files.