CVE-2025-61864: Fujielectric Monitouch V-sft UAF Flaw

CVE-2025-61864 Overview

CVE-2025-61864 is a use-after-free vulnerability [CWE-416] in the VS6ComFile!load_link_inf function of Fuji Electric V-SFT v6.2.7.0 and earlier. V-SFT is a configuration software used to develop screens for MONITOUCH human-machine interface (HMI) devices in industrial control environments. Opening a specially crafted V-SFT project file triggers improper memory handling that allows attackers to disclose information, cause an abnormal program termination (ABEND), or execute arbitrary code in the context of the user. Exploitation requires local file access and user interaction, since the victim must open the malicious file. The flaw poses risk to engineering workstations used to program operational technology (OT) equipment.

Critical Impact
A crafted V-SFT file processed by VS6ComFile!load_link_inf can lead to arbitrary code execution on engineering workstations managing Fuji Electric MONITOUCH HMI deployments.

Affected Products

Fuji Electric V-SFT v6.2.7.0 and earlier
Fuji Electric MONITOUCH V-SFT 6 development environments
Engineering workstations parsing V-SFT project files via VS6ComFile

Discovery Timeline

2025-10-10 - CVE-2025-61864 published to the National Vulnerability Database (NVD)
2025-10-27 - Last updated in NVD database

Technical Details for CVE-2025-61864

Vulnerability Analysis

The vulnerability resides in the load_link_inf routine inside VS6ComFile, a component used by V-SFT to parse linked configuration data when loading project files. The routine releases a heap object during file parsing but retains a reference to that memory. Subsequent operations dereference the stale pointer, producing classic use-after-free behavior categorized as [CWE-416]. An attacker who controls the contents of a V-SFT file can shape the freed object and the data that replaces it. This grants control over a function pointer, virtual table reference, or structured field that the parser later consumes. Successful exploitation can leak heap memory, crash the process, or redirect execution to attacker-supplied code. Because V-SFT runs on engineering workstations, code execution on these systems provides a pivot point into HMI fleets and connected industrial networks.

Root Cause

The defect stems from missing pointer invalidation after a memory free operation in VS6ComFile!load_link_inf. The parsing logic frees a structure tied to a link information record but continues to use the original handle as the file load progresses, violating object lifetime guarantees.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a malicious V-SFT file through email, removable media, shared engineering repositories, or supply chain channels. When an engineer opens the file in V-SFT, the parser invokes the vulnerable routine and triggers the use-after-free condition. No authentication to V-SFT is required, and execution occurs in the context of the logged-in user.

No verified public proof-of-concept code is available for CVE-2025-61864. See the JVN Vulnerability Report for advisory details.

Detection Methods for CVE-2025-61864

Indicators of Compromise

Unexpected crashes or ABEND events in V-SFT.exe referencing VS6ComFile.dll and the load_link_inf symbol in Windows Error Reporting data.
V-SFT project files arriving from untrusted email, web, or removable media sources on engineering workstations.
Child processes spawned by V-SFT.exe such as cmd.exe, powershell.exe, or rundll32.exe shortly after a file open event.

Detection Strategies

Hunt for process creation events where V-SFT.exe is the parent of interpreters, scripting hosts, or LOLBins.
Correlate file open telemetry of .V7, .V8, and related V-SFT project artifacts with subsequent module loads from user-writable directories.
Inspect crash dumps for access violations inside VS6ComFile!load_link_inf to identify exploitation attempts that fail before achieving code execution.

Monitoring Recommendations

Forward Windows Application and WER logs from engineering workstations to a central platform to surface repeated V-SFT.exe faults.
Monitor network egress from OT engineering hosts for outbound connections initiated shortly after V-SFT file activity.
Track creation of new persistence artifacts such as scheduled tasks, Run keys, or services on systems where V-SFT is installed.

How to Mitigate CVE-2025-61864

Immediate Actions Required

Restrict execution of V-SFT to authorized engineers and enforce least privilege on workstations that run the software.
Block inbound V-SFT files from untrusted sources at email and web gateways, including archives that may contain them.
Inventory all hosts running V-SFT v6.2.7.0 or earlier and prioritize them for patching once a fixed release is available.

Patch Information

Fuji Electric publishes V-SFT downloads and update notices through the Fuji Electric MONITOUCH download portal. Consult the JVN Vulnerability Report for vendor remediation guidance and apply the corrected V-SFT release once made available by Fuji Electric.

Workarounds

Only open V-SFT project files received through verified channels and validated with file integrity checks.
Isolate engineering workstations from general-purpose corporate networks and apply application allowlisting to limit post-exploitation actions.
Disable automatic file association handlers that launch V-SFT from browsers, mail clients, or archive utilities.

bash

# Example: enumerate V-SFT installations and versions across Windows endpoints
Get-CimInstance -ClassName Win32_Product |
  Where-Object { $_.Name -like '*V-SFT*' } |
  Select-Object Name, Version, InstallLocation