{"id":"CVE-2026-107898","kind":"vulnerability","aliases":["CVE-2026-107898"],"related":[],"title":"Fuji Electric V-SFT: crafted V7 file can leak data or run code","description":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.","summary":"V-SFT, Fuji Electric's HMI editing software, has an out-of-bounds read in its data-check code that is triggered when it opens a crafted V7 file. An attacker who gets a user to open that file may read memory or execute arbitrary code on the affected machine.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fuji-electric","hmi","industrial-control","infrastructure","v-sft","windows"],"not_affected_if":["no-v-sft-installed","trusted-files-only"],"how_to_check":"- Check the installed V-SFT version in its About or Help menu; the sources do not name the affected version range\n- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T07:17:07+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","triaged_at":"2026-10-26T07:29:50+00:00","updated_at":"2026-10-26T07:29:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T07:29:50Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Fuji Electric V-SFT: crafted V7 file can leak data or run code","impact":"high","summary":"V-SFT, Fuji Electric's HMI editing software, has an out-of-bounds read in its data-check code that is triggered when it opens a crafted V7 file. An attacker who gets a user to open that file may read memory or execute arbitrary code on the affected machine.","category":"infrastructure","nicknames":[],"who_cares":["v-sft","fuji-electric","industrial-control","hmi","windows"],"confidence":0.5,"needs_auth":"no","worst_case":"Code runs on the engineering workstation after a user opens a file.","analyst_note":"Find the affected and fixed V-SFT versions and the vendor advisory from Fuji Electric, starting from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107898.","how_to_check":"- Check the installed V-SFT version in its About or Help menu; the sources do not name the affected version range\n- unknown","needs_analyst":true,"not_affected_if":["no-v-sft-installed","trusted-files-only"],"who_is_affected":"Teams that use V-SFT to edit Fuji Electric HMI or PLC project files, especially on engineering workstations that open project files received from outside the plant. Sites that do not run V-SFT, or that only open trusted, internally created V7 files, are less exposed. The sources do not list the affected versions.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000606,"input_tokens":3310,"output_tokens":550,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107898':17A,20A '-2026':16A,19A 'affect':84B,123C 'arbitrari':80B,118C 'attack':66B 'bound':47B,100C 'cdataromerrorcheck':105C 'check':53B 'co':93C 'code':14A,54B,81B,119C 'contain':95C 'control':27B 'craft':6A,62B,109C 'cve':15A,18A 'data':11A,52B 'data-check':51B 'edit':40B 'electr':2A,23B,37B,92C 'execut':79B,120C 'exposur':116C 'file':8A,64B,74B,111C 'fuji':1A,22B,36B,91C 'fuji-electr':21B 'get':68B 'hmi':24B,39B 'industri':26B 'industrial-control':25B 'inform':115C 'infrastructur':28B 'lead':113C 'leak':10A 'ltd':94C 'machin':85B 'macrocommandcheck':106C 'may':75B,112C 'memori':77B 'open':60B,72B,107C 'out-of-bound':44B,97C 'product':124C 'provid':89C 'read':48B,76B,101C 'run':13A 'sft':5A,31B,35B,88C 'softwar':41B 'trigger':57B 'user':70B 'v':4A,30B,34B,87C 'v-sft':3A,29B,33B,86C 'v7':7A,63B,110C 'vs6editdata':104C 'vulner':102C 'window':32B","nicknames":[],"mitigations":[],"who_affected":"Teams that use V-SFT to edit Fuji Electric HMI or PLC project files, especially on engineering workstations that open project files received from outside the plant. Sites that do not run V-SFT, or that only open trusted, internally created V7 files, are less exposed. The sources do not list the affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T07:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107898","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107898","severity":null,"published_at":"2026-10-26T07:17:07+00:00","modified_at":"2026-10-26T07:17:07+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","fetched_at":"2026-10-26T07:28:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}