PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-32925 FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. CVE debrief

A stack-based buffer overflow vulnerability exists in V-SFT versions 6.2.10.0 and prior in the VS6ComFile!CV7BaseMap::WriteV7DataToRom function, which could lead to arbitrary code execution on the affected product when a crafted V7 file is opened. This vulnerability requires immediate attention from defenders, particularly those responsible for V-SFT installations in industrial control systems or critical infrastructure, to verify patching and inventory management. The vulnerability has a high CVSS score of 8.4, indicating high severity.

Vendor
FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd.
Product
V-SFT
CVSS
HIGH 8.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-01
Original CVE updated
2026-10-26
Advisory published
2026-04-01
Advisory updated
2026-10-26

Who should care

Defenders responsible for V-SFT installations, particularly those in industrial control systems or critical infrastructure, should verify patching and inventory management. They should also review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, they should check relevant monitoring, detection, and logs for exposed assets that need extra review. This vulnerability's

Why it matters

CVE-2026-32925 is a high-severity vulnerability in V-SFT that requires immediate attention from defenders. The vulnerability has a high CVSS score of 8.4 and may lead to arbitrary code execution. Defenders responsible for V-SFT installations, particularly those in industrial control systems or critical infrastructure, should verify patching and inventory management.

  • Potential for arbitrary code execution
  • High CVSS score of 8.4 indicating high severity
  • Verification of patching and inventory management required

Technical summary

The vulnerability exists in the VS6ComFile!CV7BaseMap::WriteV7DataToRom function in V-SFT versions 6.2.10.0 and prior. Opening a crafted V7 file may lead to arbitrary code execution on the affected product. The vulnerability is described in the CVE record and NVD vulnerability detail page. Fujielectric has released a patch for V-SFT version 6.2.10.0 and prior. Defenders should focus on patching and inventory management to mitigate this vulnerability.

Defensive priority

High priority for inventory checks and patching

Recommended defensive actions

  • Inventory checks for V-SFT versions 6.2.10.0 and prior
  • Patching to the latest version
  • Monitoring for suspicious V7 file openings

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. Fujielectric has released a patch for V-SFT version 6.2.10.0 and prior.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-32925 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-32925

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-32925 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32925

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.