CVE-2025-61860: Fujielectric Monitouch V-SFT Vulnerability

CVE-2025-61860 Overview

CVE-2025-61860 is an out-of-bounds read vulnerability in the VS6MemInIF!set_temp_type_default function of Fuji Electric V-SFT v6.2.7.0 and earlier. The flaw is triggered when a user opens a specially crafted V-SFT project file. Successful exploitation can lead to information disclosure, abnormal program termination (ABEND), and arbitrary code execution on the affected workstation. V-SFT is configuration software used to design screens for Monitouch human-machine interface (HMI) devices, making this an industrial control system (ICS) tooling issue.

Critical Impact
A crafted V-SFT file opened by an engineer can leak process memory and execute arbitrary code in the context of the V-SFT application, providing a foothold into operational technology (OT) engineering workstations.

Affected Products

Fuji Electric Monitouch V-SFT v6.2.7.0
Fuji Electric Monitouch V-SFT all prior v6 releases
Engineering workstations used to build Monitouch HMI projects

Discovery Timeline

2025-10-10 - CVE-2025-61860 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61860

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] inside the set_temp_type_default routine exported by the VS6MemInIF module. When V-SFT parses a crafted project file, the function reads memory beyond the bounds of an allocated buffer. The read primitive can return adjacent heap contents to attacker-controlled logic, enabling information disclosure. Depending on how the out-of-bounds data is subsequently used, the parser can dereference invalid pointers, terminate abnormally, or be steered into arbitrary code execution within the V-SFT process.

The attack requires local file delivery and user interaction. An engineer must open the malicious .V7, .V8, or related V-SFT project file for the parser to reach the vulnerable code path. Exploitation occurs at the privilege level of the user running V-SFT, which on engineering workstations is frequently a privileged account.

Root Cause

The root cause is missing or insufficient bounds validation on a length or index field parsed from the V-SFT file before it is used to index a temporary type buffer. The parser trusts file-supplied metadata and reads past the end of the allocated structure. No authentication or network exposure is involved — the attack surface is the file parser itself.

Attack Vector

An attacker crafts a malicious V-SFT project file and delivers it through phishing, removable media, a shared engineering repository, or a supply-chain handoff between integrators and asset owners. When the engineer opens the file in V-SFT, the malformed structure triggers set_temp_type_default to read past the buffer. The attacker can chain the primitive with heap grooming to leak pointers, defeat address space layout randomization (ASLR), and pivot to arbitrary code execution.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the JVN Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-61860

Indicators of Compromise

Unexpected crashes or Windows Error Reporting (WER) entries naming V-SFT.exe or VS6MemInIF.dll
V-SFT project files arriving from untrusted email, chat, or removable media before being opened on engineering workstations
Child processes spawned by V-SFT.exe such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections initiated by V-SFT.exe, which normally operates offline against HMI hardware

Detection Strategies

Monitor process lineage on engineering hosts and alert on any child process created by V-SFT.exe
Hunt for memory access violations and EXCEPTION_ACCESS_VIOLATION events tied to VS6MemInIF in application crash logs
Inspect V-SFT project files at the email and file-share gateway for structural anomalies and oversized type metadata fields

Monitoring Recommendations

Centralize Windows Application and WER logs from OT engineering workstations into the SIEM for correlation
Track file creation events for V-SFT extensions in user download and temp directories
Baseline normal V-SFT runtime behavior and alert on deviations such as new module loads or network sockets

How to Mitigate CVE-2025-61860

Immediate Actions Required

Inventory all hosts running Fuji Electric V-SFT v6 and identify versions at or below 6.2.7.0
Block opening of V-SFT project files received from external or untrusted sources until they are inspected in an isolated sandbox
Restrict V-SFT execution to dedicated engineering workstations segmented from corporate networks and the internet
Run V-SFT under a non-administrative account to reduce the impact of arbitrary code execution

Patch Information

Fuji Electric distributes updates through its Monitouch download portal. Administrators should obtain the latest V-SFT v6 release from the Fuji Electric Monitouch download site and verify the installed build is newer than 6.2.7.0. Confirm fix availability by consulting the vendor advisory linked from the JVN Vulnerability Report.

Workarounds

Only open V-SFT project files originating from trusted, integrity-verified sources
Enable Windows Defender Exploit Guard or equivalent mitigations such as Data Execution Prevention (DEP) and Control Flow Guard (CFG) for V-SFT.exe
Apply application allowlisting to prevent unauthorized child processes from launching off the V-SFT process
Use file-type filtering on email and web gateways to quarantine inbound V-SFT project files for review

bash

# Example: enable system-wide DEP and add a process mitigation policy for V-SFT on Windows
bcdedit /set {current} nx AlwaysOn
Set-ProcessMitigation -Name "V-SFT.exe" -Enable DEP,SEHOP,ForceRelocateImages,BottomUp,HighEntropy,CFG