Fuji Electric V-SFT Out-of-Bounds Read Vulnerability Allowing Information Disclosure, System Crash, and Arbitrary Code Execution

A vulnerability allowing out-of-bounds read has been identified in the VS6ComFile!get_ovlp_element_size function of V-SFT versions through 6.2.7.0. This vulnerability can be exploited by opening specially crafted V-SFT files, potentially leading to information disclosure, an abnormal system termination (ABEND), and arbitrary code execution.

Impact

Exploitation of this vulnerability may result in unauthorized information disclosure, an abnormal system termination (ABEND), and arbitrary code execution on the affected system.

Remediation

Users are advised to update V-SFT to the latest version available. Improvement information for the updated version can be found on the Fuji Electric V-SFT improvement information page.