SB2026040145 - Multiple vulnerabilities in FUJI Electric V-SFT

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Stack-based buffer overflow (CVE-ID: CVE-2026-32925)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in VS6ComFile!CV7BaseMap::WriteV7DataToRom. A remote attacker can trick a victim to open a specially crafted V7 file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

2) Out-of-bounds read (CVE-ID: CVE-2026-32926)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in VS6ComFile!load_link_inf. A remote attacker can create a specially crafted V7 file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system, leading to arbitrary code execution.

3) Out-of-bounds read (CVE-ID: CVE-2026-32927)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in VS6MemInIF!set_temp_type_default. A remote attacker can create a specially crafted V7 file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system, leading to arbitrary code execution.

4) Stack-based buffer overflow (CVE-ID: CVE-2026-32928)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in VS6ComFile!CSaveData::_conv_AnimationItem. A remote unauthenticated attacker can trick a victim to open a specially crafted V7 file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

5) Out-of-bounds read (CVE-ID: CVE-2026-32929)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in VS6ComFile!get_macro_mem_COM. A remote attacker can create a specially crafted V7 file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system, leading to arbitrary code execution.

Remediation

Install update from vendor's website.

References

• https://jvn.jp/en/vu/JVNVU90448293/index.html