CVE-2025-61858: Fujielectric Monitouch V-sft RCE Flaw

CVE-2025-61858 Overview

CVE-2025-61858 is an out-of-bounds write vulnerability in VS6ComFile!set_AnimationItem of Fuji Electric V-SFT v6. The flaw affects V-SFT v6.2.7.0 and earlier versions. Opening a specially crafted V-SFT file triggers the memory corruption condition.

Successful exploitation can lead to information disclosure, abnormal application termination (ABEND), and arbitrary code execution in the context of the user opening the file. The issue is tracked under [CWE-787] Out-of-Bounds Write and was published to the National Vulnerability Database (NVD) on October 10, 2025.

Critical Impact
A crafted V-SFT project file processed by the VS6ComFile component can corrupt memory and result in arbitrary code execution on the operator workstation running V-SFT.

Affected Products

Fuji Electric Monitouch V-SFT v6.2.7.0
Fuji Electric Monitouch V-SFT prior versions of the v6 branch
Systems that process V-SFT project files using the VS6ComFile component

Discovery Timeline

2025-10-10 - CVE-2025-61858 published to NVD
2025-10-27 - Last updated in NVD database

Technical Details for CVE-2025-61858

Vulnerability Analysis

The vulnerability resides in the set_AnimationItem method exported by the VS6ComFile component used by Fuji Electric Monitouch V-SFT v6. V-SFT is the configuration software used to design screens and project files for Monitouch HMI (Human-Machine Interface) panels deployed in industrial environments.

When V-SFT parses a crafted project file, set_AnimationItem writes attacker-influenced data outside the bounds of an allocated buffer. The out-of-bounds write corrupts adjacent memory structures, which an attacker can shape to achieve code execution or to leak data from the host process.

Exploitation requires user interaction. An engineer or operator must open the malicious V-SFT file, which makes spear-phishing and supply-chain delivery of project files the most plausible delivery paths in industrial control system (ICS) environments.

Root Cause

The root cause is missing or insufficient bounds validation in VS6ComFile!set_AnimationItem when handling animation item data parsed from a V-SFT file. Sizes or indices read from the file are used to write into a fixed-size buffer without being constrained against the destination capacity, satisfying the conditions described by [CWE-787].

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted V-SFT file by email, removable media, shared engineering workstations, or compromised vendor distribution. When the target opens the file in a vulnerable version of V-SFT, the parser invokes set_AnimationItem and triggers the out-of-bounds write. Code execution occurs at the privilege level of the user running V-SFT.

No public proof-of-concept exploit is currently available, and the issue is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. See the JVN Vulnerability Report for additional advisory detail.

Detection Methods for CVE-2025-61858

Indicators of Compromise

Unexpected crashes (ABEND) of V-SFT.exe or processes loading VS6ComFile shortly after a project file is opened
V-SFT project files arriving from untrusted email, file shares, or external media before a crash event
Child processes spawned by V-SFT.exe such as command shells, scripting hosts, or LOLBins
Outbound network connections initiated by V-SFT.exe to unexpected destinations

Detection Strategies

Monitor process crashes and Windows Error Reporting (WER) events tied to V-SFT.exe and VS6ComFile.dll
Alert on engineering workstations where V-SFT spawns interactive shells, PowerShell, or rundll32
Apply file-write monitoring for V-SFT project artifacts dropped into operator inboxes or shared engineering directories
Correlate user-initiated file opens with subsequent anomalous process or memory activity on the same host

Monitoring Recommendations

Inventory all hosts running Monitouch V-SFT v6 and confirm installed versions against v6.2.7.0
Forward endpoint process, image-load, and crash telemetry from engineering workstations into a centralized analytics or SIEM platform
Track inbound delivery of V-SFT project files across email, web, and removable media channels
Review historical telemetry on V-SFT hosts for prior crashes consistent with parser failures

How to Mitigate CVE-2025-61858

Immediate Actions Required

Identify and inventory all systems running Fuji Electric Monitouch V-SFT v6.2.7.0 or earlier
Restrict opening of V-SFT files to known, trusted sources and verified internal projects
Isolate engineering workstations from general-purpose email and web browsing where feasible
Apply the vendor-provided update as soon as it is available from the Fuji Electric download portal

Patch Information

Fuji Electric distributes updates through the Monitouch download portal. Refer to the Fuji Electric Monitouch V-SFT Download Center for the latest fixed release of V-SFT v6 and apply it to all engineering workstations. Coordinate updates with operational technology (OT) change-management processes.

Workarounds

Do not open V-SFT project files received from untrusted or unverified sources
Run V-SFT under a standard user account rather than an administrator account to reduce the impact of code execution
Open suspicious project files only on an isolated, non-production workstation segmented from the ICS network
Enforce application allowlisting on engineering hosts to constrain processes spawned by V-SFT.exe

bash

# Example: list installed V-SFT versions on Windows engineering hosts via PowerShell
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*V-SFT*" } | Select-Object Name, Version, Vendor