A critical out-of-bounds read vulnerability in Fuji Electric V-SFT v6.2.7.0 and earlier poses a significant risk of arbitrary code execution and system instability.

This is an out-of-bounds read flaw (CWE-125) occurring within the VS6ComFile!CSaveData::delete_mem function. The vulnerability can be triggered by an unauthenticated user if they are coerced into opening a specially crafted V-SFT file.

The potential for arbitrary code execution and system failure (ABEND) represents a severe threat to operational continuity and data integrity. With a CVSS score of 7.8, this vulnerability is categorized as High, reflecting the significant impact on system availability and the potential for unauthorized control over the affected workstation.

Immediate Action: Update the V-SFT software to the latest version provided by the vendor to ensure the vulnerability is patched.

Proactive Monitoring: Monitor system logs for abnormal application termination events or unexpected file access patterns associated with V-SFT project files.

Compensating Controls: Restrict the opening of V-SFT files from untrusted or unknown sources and ensure that users operate with the minimum necessary privileges to reduce the potential impact of an exploit.

Public Exploit Available: No

Given the potential for arbitrary code execution, this vulnerability should be prioritized for remediation within your software maintenance cycle. Administrators must verify their current version of V-SFT and apply the vendor-supplied security updates as soon as they are made available to mitigate the risk of system compromise.