CVE-2025-47752: Fujielectric Monitouch V-SFT RCE Flaw

CVE-2025-47752 Overview

CVE-2025-47752 is an out-of-bounds write vulnerability [CWE-787] affecting Fuji Electric V-SFT v6.2.5.0 and earlier. The flaw resides in the VS6ComFile!MakeItemGlidZahyou function. Opening a specially crafted V7 or V8 project file triggers the condition, which can result in process crash, information disclosure, or arbitrary code execution under the context of the current user.

V-SFT is engineering software used to design screens for Monitouch human-machine interface (HMI) panels deployed in industrial environments. Exploitation requires user interaction, so attackers typically deliver weaponized project files through phishing or trusted file-sharing channels targeting control system engineers.

Critical Impact
Successful exploitation grants arbitrary code execution on engineering workstations used to program industrial HMI devices, providing a pivot point into operational technology (OT) networks.

Affected Products

Fuji Electric Monitouch V-SFT v6.2.5.0
Fuji Electric Monitouch V-SFT versions earlier than v6.2.5.0
V7 and V8 project file parsing components (VS6ComFile.dll)

Discovery Timeline

2025-05-19 - CVE-2025-47752 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47752

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in the MakeItemGlidZahyou function exported by the VS6ComFile module. When V-SFT parses a V7 or V8 project file, the function writes data beyond the bounds of an allocated buffer based on attacker-controlled values embedded in the file structure.

The out-of-bounds write corrupts adjacent memory in the V-SFT process address space. Depending on what is overwritten, the result ranges from an application crash to controlled memory corruption suitable for code execution. Because V-SFT is a Windows desktop application, exploitation runs in the user context, which on engineering workstations frequently includes local administrator privileges.

Root Cause

The root cause is missing or insufficient bounds validation on length or index fields read from the V7/V8 project file format before the function writes into its internal buffer. The parser trusts file-supplied size metadata when populating coordinate or item structures handled by MakeItemGlidZahyou.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious V7 or V8 file and delivers it to a V-SFT operator through email, removable media, or a shared engineering repository. Opening the file in a vulnerable version of V-SFT triggers the out-of-bounds write inside VS6ComFile.dll.

The vulnerability manifests during file parsing in the MakeItemGlidZahyou routine. Refer to the JVN Vulnerability Report for vendor-coordinated technical details.

Detection Methods for CVE-2025-47752

Indicators of Compromise

Unexpected crashes of V-SFT.exe or modules loaded from VS6ComFile.dll recorded in Windows Application event logs
V7 or V8 project files received from untrusted sources or arriving outside normal engineering workflows
Child processes spawned by V-SFT.exe such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections initiated by the V-SFT process to non-vendor destinations

Detection Strategies

Monitor process lineage for V-SFT.exe spawning shell, scripting, or LOLBin processes, which is uncharacteristic of normal engineering workflow.
Alert on writes from the V-SFT process to startup, scheduled task, or persistence locations in the Windows registry and filesystem.
Apply YARA or file-type inspection rules to V7 and V8 files transferred via email gateways or file shares.

Monitoring Recommendations

Inventory all engineering workstations running V-SFT and track installed version against the patched release.
Forward endpoint telemetry from OT engineering hosts to a centralized analytics platform for behavioral correlation.
Audit removable media usage and email attachments delivered to engineering staff who handle Monitouch HMI projects.

How to Mitigate CVE-2025-47752

Immediate Actions Required

Upgrade V-SFT to the fixed release available from the Fuji Electric Monitouch download portal.
Restrict V-SFT installations to engineering workstations that do not have direct internet access.
Block inbound V7 and V8 file attachments at email gateways unless they originate from verified internal sources.
Treat engineering workstations as high-value assets and enforce least-privilege user accounts where feasible.

Patch Information

Fuji Electric distributes updated V-SFT installers through the official Monitouch V-SFT6 download site. Verify the installer signature and confirm the version is later than 6.2.5.0 before deployment. Coordinated disclosure details are tracked in JVN VU#97228144.

Workarounds

Do not open V7 or V8 project files from untrusted, unsolicited, or unverified sources.
Segment engineering workstations from corporate networks and the internet to limit delivery channels for malicious files.
Use file integrity checks and version control for project files exchanged between engineers and integrators.
Disable or restrict execution of unsigned scripts and binaries on engineering hosts to constrain post-exploitation activity.

bash

# Example: Verify installed V-SFT version on a Windows engineering workstation
powershell -Command "Get-ItemProperty 'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object { $_.DisplayName -like 'V-SFT*' } | Select-Object DisplayName, DisplayVersion"