CVE-2025-61859: Fujielectric Monitouch V-sft RCE Flaw

CVE-2025-61859 Overview

CVE-2025-61859 is an out-of-bounds write vulnerability in the VS6ComFile!CItemDraw::is_motion_tween function of Fuji Electric V-SFT v6.2.7.0 and earlier. The flaw is triggered when a user opens a specially crafted V-SFT file in the affected application. Successful exploitation can lead to information disclosure, abnormal program termination (ABEND), and arbitrary code execution on the affected system. V-SFT is a configuration tool used to design screens for Monitouch HMI (Human-Machine Interface) devices deployed in industrial control environments, making this issue relevant to operational technology (OT) engineering workstations.

Critical Impact
An attacker who convinces an engineer to open a malicious V-SFT project file can execute arbitrary code in the context of the user, potentially compromising HMI configuration data and adjacent industrial systems.

Affected Products

Fuji Electric Monitouch V-SFT v6.2.7.0
Fuji Electric Monitouch V-SFT v6 prior versions
Component: VS6ComFile (function CItemDraw::is_motion_tween)

Discovery Timeline

2025-10-10 - CVE-2025-61859 published to NVD
2025-10-27 - Last updated in NVD database

Technical Details for CVE-2025-61859

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds write [CWE-787] within the VS6ComFile module of V-SFT v6. The defective code path resides in CItemDraw::is_motion_tween, a routine involved in parsing motion tween animation data inside V-SFT project files. When the parser processes attacker-controlled fields, it writes data past the end of an allocated buffer. This memory corruption can overwrite adjacent objects, function pointers, or control structures on the heap or stack.

The attack vector is local and requires user interaction. An attacker must deliver a crafted V-SFT file to a victim and convince them to open it in the vulnerable application. Because V-SFT is used by control engineers, malicious files can be delivered through phishing, shared engineering repositories, USB media, or supply chain channels common in industrial environments.

Root Cause

The root cause is missing or incorrect bounds validation on length or index fields parsed from the V-SFT file format before the is_motion_tween routine writes data into a fixed-size buffer. Without proper validation, attacker-supplied values steer write operations beyond the buffer boundary, corrupting adjacent memory.

Attack Vector

Exploitation requires the targeted user to open a malicious V-SFT file. The outcomes range from a process crash (ABEND, denial of service) to leakage of in-process memory and arbitrary code execution. Code execution occurs in the security context of the user running V-SFT, which on engineering workstations is often a privileged operator account.

No public proof-of-concept exploit and no in-the-wild exploitation have been reported. Technical specifics of the file format fields involved are not disclosed in the vendor advisory; see the JVN Vulnerability Report for additional context.

Detection Methods for CVE-2025-61859

Indicators of Compromise

Unexpected crashes or ABEND of V-SFT.exe or processes loading VS6ComFile.dll shortly after opening a project file
Creation of child processes from V-SFT (for example, cmd.exe, powershell.exe, or scripting hosts) that are not expected during normal engineering workflows
V-SFT project files (.V8, .V9, V-SFT v6 project artifacts) received from untrusted sources or untrusted email senders
New persistence artifacts, scheduled tasks, or outbound network connections originating from engineering workstations after V-SFT file activity

Detection Strategies

Monitor Windows Error Reporting and application crash events involving the VS6ComFile module on hosts where V-SFT is installed
Hunt for V-SFT project files arriving via email gateways, file shares, or removable media on OT engineering segments
Correlate process-creation telemetry where V-SFT.exe is the parent process of interpreters, shells, or LOLBins
Inspect EDR memory exception telemetry for heap corruption signatures within the V-SFT process

Monitoring Recommendations

Baseline normal V-SFT process behavior on engineering workstations and alert on deviations such as unexpected module loads or network egress
Forward application crash logs and EDR process telemetry from OT engineering hosts to a centralized SIEM or data lake for retroactive hunting
Track inbound delivery of V-SFT project file extensions and quarantine those originating from outside the trusted engineering perimeter

How to Mitigate CVE-2025-61859

Immediate Actions Required

Inventory all systems running Fuji Electric V-SFT v6 and identify versions at or below v6.2.7.0
Instruct engineers to refuse opening V-SFT project files received from untrusted or unverified sources
Restrict V-SFT installations to dedicated engineering workstations isolated from general-purpose user environments
Apply the vendor-supplied fixed release once available from the Fuji Electric download portal

Patch Information

Fuji Electric publishes updated V-SFT v6 builds on the official Fuji Electric Monitouch Download page. Administrators should download and deploy the latest available version, which contains the fix for the out-of-bounds write in CItemDraw::is_motion_tween. Refer to the JVN Vulnerability Report for vendor-coordinated guidance.

Workarounds

Open V-SFT files only from authenticated, internal engineering repositories with integrity controls
Run V-SFT under a standard (non-administrator) Windows account to limit the impact of code execution
Segment engineering workstations from corporate IT networks and the internet using firewall rules aligned with the Purdue model
Use application allowlisting on engineering hosts to block child processes spawned by V-SFT.exe

bash

# Example: query installed V-SFT version on Windows engineering workstations
wmic product where "Name like 'V-SFT%%'" get Name,Version

# Example: PowerShell file integrity check before opening shared project files
Get-FileHash -Algorithm SHA256 -Path 'C:\Projects\example.V8'