Fuji Electric V-SFT Out-of-Bounds Write Vulnerability Allowing Information Disclosure, System Crash, and Arbitrary Code Execution

A vulnerability allowing out-of-bounds write has been identified in the V-SFT software by Fuji Electric, specifically in the version 6.2.7.0 and earlier. This vulnerability resides in the 'VS6ComFile!CItemDraw::is_motion_tween' function. Exploiting this vulnerability involves opening specially crafted V-SFT files, which can lead to unauthorized information disclosure, cause the affected system to experience an abnormal termination, and allow for arbitrary code execution.

Impact

Exploitation of this vulnerability can result in unauthorized information disclosure, abnormal termination of the affected system, and arbitrary code execution.

Remediation

Users are advised to update the software to the latest version available. Improvement information for V-SFT version 6 can be found on the Fuji Electric Monitouch website.