{"id":"CVE-2026-107900","kind":"vulnerability","aliases":["CVE-2026-107900"],"related":[],"title":"Fuji Electric V-SFT: crafted V7 file triggers out-of-bounds read","description":"V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.","summary":"V-SFT, Fuji Electric's industrial HMI engineering software, has an out-of-bounds read in its VS6ComFile component when it opens a crafted V7 file. An attacker who gets a user to open such a file may read memory and could run arbitrary code on the affected product.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fuji-electric","industrial-control","other","v-sft","windows"],"not_affected_if":["no-untrusted-v7-files"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T07:17:08+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","triaged_at":"2026-10-26T07:29:49+00:00","updated_at":"2026-10-26T07:29:49+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-26T07:29:49Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Fuji Electric V-SFT: crafted V7 file triggers out-of-bounds read","impact":"high","summary":"V-SFT, Fuji Electric's industrial HMI engineering software, has an out-of-bounds read in its VS6ComFile component when it opens a crafted V7 file. An attacker who gets a user to open such a file may read memory and could run arbitrary code on the affected product.","category":"other","nicknames":[],"who_cares":["v-sft","fuji-electric","industrial-control","windows"],"confidence":0.5,"needs_auth":"no","worst_case":"Memory exposure or arbitrary code execution when a crafted file is opened","analyst_note":"Find affected V-SFT versions and the vendor fix in the Fuji Electric advisory; the NVD entry gives no version range or patch.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-untrusted-v7-files"],"who_is_affected":"Teams that run Fuji Electric V-SFT for industrial HMI programming are affected when they open V7 project files from untrusted sources. Sites that never open files from outside sources have less exposure. The sources do not give affected versions.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000561,"input_tokens":3301,"output_tokens":461,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107900':17A,20A '-2026':16A,19A 'affect':81B,120C 'arbitrari':77B,115C 'attack':61B 'bound':13A,47B,97C 'ccheck':102C 'co':90C 'code':78B,116C 'compon':52B 'contain':92C 'control':26B 'could':75B 'craft':6A,57B,106C 'cve':15A,18A 'electr':2A,23B,36B,89C 'engin':40B 'execut':117C 'exposur':113C 'file':8A,59B,70B,108C 'fuji':1A,22B,35B,88C 'fuji-electr':21B 'get':63B 'hmi':39B 'industri':25B,38B 'industrial-control':24B 'inform':112C 'itemcheck':103C 'lead':110C 'ltd':91C 'may':71B,109C 'memori':73B 'open':55B,67B,104C 'out-of-bound':10A,44B,94C 'product':82B,121C 'provid':86C 'read':14A,48B,72B,98C 'run':76B 'sft':5A,30B,34B,85C 'softwar':41B 'trigger':9A 'user':65B 'v':4A,29B,33B,84C 'v-sft':3A,28B,32B,83C 'v7':7A,58B,107C 'vs6comfile':51B,101C 'vulner':99C 'window':31B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Fuji Electric V-SFT for industrial HMI programming are affected when they open V7 project files from untrusted sources. Sites that never open files from outside sources have less exposure. The sources do not give affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T07:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107900","severity":null,"published_at":"2026-10-26T07:17:08+00:00","modified_at":"2026-10-26T07:17:08+00:00","first_seen_at":"2026-10-26T07:28:49+00:00","fetched_at":"2026-10-26T07:28:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}