CVE-2025-47749: Fujielectric Monitouch V-sft RCE Flaw

CVE-2025-47749 Overview

CVE-2025-47749 affects Fuji Electric V-SFT v6.2.5.0 and earlier. The flaw exists in the CWinFontInf::WinFontMsgCheck function inside VS6EditData.dll. The function frees a pointer that is not at the start of a buffer, classified as [CWE-761] and [CWE-763]. Opening a specially crafted V7 or V8 project file triggers the issue. Successful exploitation can lead to application crash, information disclosure, or arbitrary code execution in the context of the engineering workstation user.

Critical Impact
A crafted V7 or V8 file processed by V-SFT can corrupt heap metadata, enabling arbitrary code execution on operator and engineering workstations used to program Fuji Electric Monitouch HMIs.

Affected Products

Fuji Electric Monitouch V-SFT v6.2.5.0
Fuji Electric Monitouch V-SFT all prior v6.x releases
V7 and V8 project file handlers within VS6EditData.dll

Discovery Timeline

2025-05-19 - CVE-2025-47749 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47749

Vulnerability Analysis

The vulnerability resides in the WinFontMsgCheck routine exported by VS6EditData.dll, a component used by V-SFT to parse font and message data embedded in V7 and V8 project files. When the routine processes a malformed record, it advances an internal pointer through the buffer during parsing. The same advanced pointer is later passed to the heap deallocator instead of the original allocation address. This produces a free of pointer not at start of buffer condition, corrupting heap metadata.

Exploitation requires the victim to open a crafted file in V-SFT. Because V-SFT runs locally on engineering workstations that program Monitouch HMI panels, an attacker delivering the file through email, removable media, or shared project repositories can reach the vulnerable code path. The combined confidentiality, integrity, and availability impact aligns with arbitrary code execution within the user's session.

Root Cause

The root cause is incorrect pointer arithmetic management during font message validation. VS6EditData.dll increments a working pointer while iterating through buffer fields but does not retain a reference to the base allocation. When the parser hits an error path, it calls free on the working pointer. The heap allocator then attempts to update chunk headers at an attacker-influenced offset, enabling controlled corruption suitable for write-what-where primitives.

Attack Vector

The attack is local and requires user interaction. An adversary crafts a V7 or V8 file with malformed font message structures and convinces an engineer or operator to open it in V-SFT. No prior authentication to the workstation is required beyond the user opening the file. Following corruption, the attacker can pivot to arbitrary code execution in the user context, then target connected operational technology assets.

No public proof-of-concept code is currently available for CVE-2025-47749. Refer to the JVN Security Advisory for vendor-coordinated technical details.

Detection Methods for CVE-2025-47749

Indicators of Compromise

Unexpected crashes of V-SFT.exe or faulting module VS6EditData.dll recorded in Windows Application event logs.
WER (Windows Error Reporting) dumps referencing heap corruption exceptions such as STATUS_HEAP_CORRUPTION (0xC0000374) from V-SFT processes.
Inbound V7 or V8 project files arriving from external email, USB media, or unmanaged file shares prior to a V-SFT crash event.
Child processes spawned by V-SFT.exe such as cmd.exe, powershell.exe, or rundll32.exe, which are anomalous for an HMI engineering tool.

Detection Strategies

Hunt for process creation events where the parent image is V-SFT.exe and the child is a scripting interpreter or LOLBin.
Alert on module load events for VS6EditData.dll followed by an access violation or process termination within a short window.
Inspect file write events on engineering workstations for .V7 and .V8 files originating from non-engineering shares or removable media.

Monitoring Recommendations

Forward Windows Application, Security, and Sysmon logs from engineering workstations to a centralized analytics platform for correlation.
Enable command-line auditing and module load logging (Sysmon Event IDs 1, 7, 11) on hosts where V-SFT is installed.
Track outbound network connections initiated by V-SFT.exe or its child processes, which should be rare in normal use.

How to Mitigate CVE-2025-47749

Immediate Actions Required

Restrict V-SFT installations to dedicated engineering workstations and limit interactive logon to authorized engineers.
Block delivery of .V7 and .V8 files through email gateways and quarantine such attachments for review.
Disable autorun for removable media on hosts that run V-SFT to prevent automatic file launching.
Apply application allowlisting so that only signed, expected child processes can launch from V-SFT.exe.

Patch Information

Fuji Electric publishes updated V-SFT v6 installers on the Fuji Electric Monitouch download portal. Upgrade to a release later than v6.2.5.0 once available, and verify the installed version through Help > About inside V-SFT. Coordinate the upgrade with HMI project file compatibility testing before deploying broadly across plant systems.

Workarounds

Only open V7 and V8 files from trusted, internally generated sources and validate file origin out of band.
Segment engineering workstations from corporate networks using firewall rules consistent with IEC 62443 zone and conduit guidance.
Run V-SFT under a standard user account rather than a local administrator to limit post-exploitation impact.
Maintain offline backups of HMI project files so suspect files can be replaced with known-good versions.

bash

# Example: block .V7 and .V8 attachments at an SMTP gateway (Postfix header_checks)
/^Content-(Disposition|Type).*name\s*=\s*"?.*\.(v7|v8)"?/  REJECT V-SFT project files are not permitted via email