A critical out-of-bounds read vulnerability in Fuji Electric V-SFT software could allow an attacker to achieve unauthorized information disclosure through the use of a specially crafted file.

The software contains an out-of-bounds read flaw within the VS6ComFile!load_link_inf function. This vulnerability is triggered when the application processes a malicious V7 file, and it does not require prior authentication from the attacker.

The exploitation of this vulnerability can lead to significant information disclosure, potentially exposing sensitive data processed or stored within the V-SFT environment. With a CVSS score of 7.8, this flaw represents a high risk to operational integrity, as it allows attackers to gain unauthorized visibility into system memory or file contents. This may facilitate further attacks or result in the loss of intellectual property and proprietary configuration data.

Immediate Action: Update the V-SFT software to the version specified in the vendor advisory to patch the vulnerable VS6ComFile component.

Proactive Monitoring: Monitor system logs for unexpected application crashes or errors during file import operations, which may indicate an exploitation attempt.

Compensating Controls: Restrict the ability of users to open untrusted project files from external or unknown sources until the software has been updated.

Public Exploit Available: Unknown

Given the potential for sensitive information disclosure, organizations utilizing V-SFT should prioritize applying the vendor-supplied patch. Users should exercise caution when handling V7 files from untrusted sources while the remediation process is underway to minimize the risk of accidental exposure.