{"id":"CVE-2026-107896","kind":"vulnerability","aliases":["CVE-2026-107896"],"related":[],"title":"Fuji Electric V-SFT: crafted V7 file triggers out-of-bounds read, code execution","description":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.","summary":"V-SFT, Fuji Electric's HMI screen-design software, has an out-of-bounds read in its VS6ComFile load_gr_item routine. Opening a crafted V7 file may expose information or allow arbitrary code execution on the affected product.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fuji-electric","hmi","industrial-control","infrastructure","v-sft","windows"],"not_affected_if":["no-v-sft-installed","no-v7-files-opened"],"how_to_check":"- Identify whether V-SFT is installed on engineering workstations and note the installed version (unknown: the sources do not give the affected version range or where the version is shown)\n- Check whether untrusted or third-party V7 project files are opened in V-SFT (unknown: the sources do not say how the files are delivered)","fix":"- Update V-SFT to the fixed release from Fuji Electric (unknown: the sources do not name the fixed version)\n- Open V7 files only from trusted sources until patched (unknown: the sources do not give a vendor workaround)","status":"open","published_at":"2026-10-26T07:17:07+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","triaged_at":"2026-10-26T07:29:53+00:00","updated_at":"2026-10-26T07:29:53+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T07:29:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update V-SFT to the fixed release from Fuji Electric (unknown: the sources do not name the fixed version)\n- Open V7 files only from trusted sources until patched (unknown: the sources do not give a vendor workaround)","reach":"local","title":"Fuji Electric V-SFT: crafted V7 file triggers out-of-bounds read, code execution","impact":"high","summary":"V-SFT, Fuji Electric's HMI screen-design software, has an out-of-bounds read in its VS6ComFile load_gr_item routine. Opening a crafted V7 file may expose information or allow arbitrary code execution on the affected product.","category":"infrastructure","nicknames":[],"who_cares":["v-sft","fuji-electric","hmi","industrial-control","windows"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Code runs on the engineering workstation when a crafted file is opened","analyst_note":"Find the affected and fixed V-SFT versions and the vendor advisory from Fuji Electric; the NVD entry alone does not give them.","how_to_check":"- Identify whether V-SFT is installed on engineering workstations and note the installed version (unknown: the sources do not give the affected version range or where the version is shown)\n- Check whether untrusted or third-party V7 project files are opened in V-SFT (unknown: the sources do not say how the files are delivered)","needs_analyst":true,"not_affected_if":["no-v-sft-installed","no-v7-files-opened"],"who_is_affected":"Teams that use V-SFT to create or edit Fuji Electric HMI screen projects, especially those who open V7 project files received from outside their organization. Systems that do not run V-SFT or never open V7 files are unlikely to be exposed. The sources do not say which V-SFT versions are affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":3296,"output_tokens":664,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107896':19A,22A '-2026':18A,21A 'affect':75B,115C 'allow':69B 'arbitrari':70B,110C 'bound':13A,51B,91C 'co':84C 'code':15A,71B,111C 'contain':86C 'control':29B 'craft':6A,62B,101C 'cve':17A,20A 'design':44B 'electr':2A,25B,39B,83C 'execut':16A,72B,112C 'expos':66B 'exposur':108C 'file':8A,64B,103C 'fuji':1A,24B,38B,82C 'fuji-electr':23B 'gr':57B,97C 'hmi':26B,41B 'industri':28B 'industrial-control':27B 'inform':67B,107C 'infrastructur':30B 'item':58B,98C 'lead':105C 'load':56B,96C 'ltd':85C 'may':65B,104C 'open':60B,99C 'out-of-bound':10A,48B,88C 'product':76B,116C 'provid':80C 'read':14A,52B,92C 'routin':59B 'screen':43B 'screen-design':42B 'sft':5A,33B,37B,79C 'softwar':45B 'trigger':9A 'v':4A,32B,36B,78C 'v-sft':3A,31B,35B,77C 'v7':7A,63B,102C 'vs6comfile':55B,95C 'vulner':93C 'window':34B","nicknames":[],"mitigations":[],"who_affected":"Teams that use V-SFT to create or edit Fuji Electric HMI screen projects, especially those who open V7 project files received from outside their organization. Systems that do not run V-SFT or never open V7 files are unlikely to be exposed. The sources do not say which V-SFT versions are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T07:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107896","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107896","severity":null,"published_at":"2026-10-26T07:17:07+00:00","modified_at":"2026-10-26T07:17:07+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","fetched_at":"2026-10-26T07:28:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}