{"id":"CVE-2026-107897","kind":"vulnerability","aliases":["CVE-2026-107897"],"related":[],"title":"Fuji Electric V-SFT: crafted V7 file triggers out-of-bounds read, code execution","description":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.","summary":"V-SFT, Fuji Electric's HMI configuration software, has an out-of-bounds read in its VS6MemInIF set_temp_type_default routine. Opening a crafted V7 file may expose information or let an attacker run arbitrary code on the affected product.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fuji-electric","hmi","ics","infrastructure","v-sft","windows"],"not_affected_if":["no-untrusted-v7-files"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T07:17:07+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","triaged_at":"2026-10-26T07:29:49+00:00","updated_at":"2026-10-26T07:29:49+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T07:29:49Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Fuji Electric V-SFT: crafted V7 file triggers out-of-bounds read, code execution","impact":"high","summary":"V-SFT, Fuji Electric's HMI configuration software, has an out-of-bounds read in its VS6MemInIF set_temp_type_default routine. Opening a crafted V7 file may expose information or let an attacker run arbitrary code on the affected product.","category":"infrastructure","nicknames":[],"who_cares":["fuji-electric","v-sft","ics","hmi","windows"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the engineering or HMI machine","analyst_note":"Find the affected V-SFT versions, the patched version and Fuji Electric's advisory text at the NVD URL or JVN/vendor page; confirm whether runtime HMI is affected.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-untrusted-v7-files"],"who_is_affected":"Teams that open V-SFT project files, including files received from outside their organization, on engineering workstations are exposed to a crafted V7 file. The sources do not list affected V-SFT versions or say whether the runtime HMI is also at risk. Teams that never open untrusted V7 files are unlikely to be affected, but the sources do not confirm this.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.00059,"input_tokens":3299,"output_tokens":520,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107897':19A,22A '-2026':18A,21A 'affect':74B,115C 'arbitrari':70B,110C 'attack':68B 'bound':13A,47B,90C 'co':83C 'code':15A,71B,111C 'configur':40B 'contain':85C 'craft':6A,59B,101C 'cve':17A,20A 'default':55B,98C 'electr':2A,25B,37B,82C 'execut':16A,112C 'expos':63B 'exposur':108C 'file':8A,61B,103C 'fuji':1A,24B,36B,81C 'fuji-electr':23B 'hmi':26B,39B 'ic':27B 'inform':64B,107C 'infrastructur':28B 'lead':105C 'let':66B 'ltd':84C 'may':62B,104C 'open':57B,99C 'out-of-bound':10A,44B,87C 'product':75B,116C 'provid':79C 'read':14A,48B,91C 'routin':56B 'run':69B 'set':52B,95C 'sft':5A,31B,35B,78C 'softwar':41B 'temp':53B,96C 'trigger':9A 'type':54B,97C 'v':4A,30B,34B,77C 'v-sft':3A,29B,33B,76C 'v7':7A,60B,102C 'vs6meminif':51B,94C 'vulner':92C 'window':32B","nicknames":[],"mitigations":[],"who_affected":"Teams that open V-SFT project files, including files received from outside their organization, on engineering workstations are exposed to a crafted V7 file. The sources do not list affected V-SFT versions or say whether the runtime HMI is also at risk. Teams that never open untrusted V7 files are unlikely to be affected, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T07:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107897","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107897","severity":null,"published_at":"2026-10-26T07:17:07+00:00","modified_at":"2026-10-26T07:17:07+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","fetched_at":"2026-10-26T07:28:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}