Fuji Electric V-SFT: Stack-based buffer overflow (CVE-2026-107894)
Fuji Electric V-SFT is vulnerable to a stack-based buffer overflow during the parsing of crafted V7 files, potentially enabling arbitrary code execution.
CVE search metadata
CVE search record: CVE-2026-107894. Severity: high. CVSS: 7.8. KEV: no. Product: V-SFT. Brief: Fuji Electric V-SFT: Stack-based buffer overflow (CVE-2026-107894). Brief link: https://feed.craftedsignal.io/briefs/2026-10-fuji-v-sft-overflow/
CVE search record: CVE-2026-107895. Severity: high. CVSS: 7.8. KEV: no. Product: V-SFT. Brief: Fuji Electric V-SFT: Stack-based buffer overflow (CVE-2026-107894). Brief link: https://feed.craftedsignal.io/briefs/2026-10-fuji-v-sft-overflow/
Triage facts
Revision 1- Applicability
- V-SFT
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 26, 07:37 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Roughly even chance
What's new
- 1. added CVE-2026-107895 Oct 26, 07:37 via nvd
Fuji Electric V-SFT contains a stack-based buffer overflow vulnerability identified as CVE-2026-107894. This vulnerability is triggered when the application parses a specially crafted V7 file. Successful exploitation may result in information exposure or arbitrary code execution within the context of the application.
Impact
Successful exploitation could lead to arbitrary code execution or unauthorized information disclosure.
Recommendation
- Identify all instances of Fuji Electric V-SFT software within the organization.
- Monitor for unusual file-opening activity or unexpected child processes originating from the V-SFT application process.
- Check with the vendor for the availability of security updates or patches addressing CVE-2026-107894 and deploy them to all affected systems.
Immediate actions
Inventory all hosts running Fuji Electric V-SFT software.
Threat Hunt
Monitor for V-SFT process execution followed by suspicious child processes (e.g., cmd.exe, powershell.exe, or uncommon network connections).
Data: Endpoint process creation logs
Mitigations
Apply vendor security patches for CVE-2026-107894 once released.
CVE-2026-107894