CVE-2026-32929: V-SFT Information Disclosure Vulnerability

CVE-2026-32929 Overview

CVE-2026-32929 is an out-of-bounds read vulnerability affecting Fuji Electric V-SFT versions 6.2.10.0 and prior. The vulnerability exists in the VS6ComFile!get_macro_mem_COM function, where improper bounds checking allows an attacker to craft a malicious V7 file that, when opened by a user, can lead to information disclosure from the affected application's memory space.

Critical Impact

Successful exploitation of this vulnerability could allow an attacker to read sensitive information from memory, potentially exposing confidential data, application secrets, or memory contents that could be leveraged for further attacks.

Affected Products

• V-SFT version 6.2.10.0
• V-SFT versions prior to 6.2.10.0
• Fuji Electric V-SFT HMI configuration software

Discovery Timeline

• 2026-04-01 - CVE CVE-2026-32929 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-32929

Vulnerability Analysis

This vulnerability is classified under CWE-125 (Out-of-Bounds Read), a memory corruption flaw that occurs when an application reads data past the boundary of an allocated memory buffer. In the context of V-SFT, the VS6ComFile!get_macro_mem_COM function fails to properly validate boundaries when processing V7 project files.

The attack requires local access and user interaction—specifically, a victim must open a specially crafted V7 file. Once opened, the vulnerable function reads beyond the intended memory boundaries, potentially exposing sensitive information stored in adjacent memory regions. This could include configuration data, memory addresses useful for defeating ASLR, or other sensitive application state information.

The impact extends beyond simple information disclosure; leaked memory contents could provide an attacker with valuable reconnaissance data to chain with other vulnerabilities for a more severe attack, such as remote code execution.

Root Cause

The root cause of CVE-2026-32929 lies in insufficient bounds checking within the VS6ComFile!get_macro_mem_COM function when parsing macro memory data from V7 files. The function does not adequately verify that read operations remain within the bounds of allocated buffers, allowing crafted input to trigger reads from unintended memory locations.

V7 files contain project configuration data for V-SFT HMI projects, and the parsing logic trusts size or offset values embedded in the file format without proper validation. An attacker can manipulate these values to cause the application to read beyond buffer boundaries.

Attack Vector

The attack vector for this vulnerability is local, requiring user interaction. An attacker would need to:

1. Craft a malicious V7 file with manipulated offset or size values targeting the vulnerable parsing function
2. Deliver the malicious file to a victim through social engineering, email attachments, or file-sharing mechanisms
3. Convince the victim to open the crafted V7 file using the vulnerable V-SFT application
4. Upon file parsing, the out-of-bounds read triggers, potentially disclosing memory contents

The vulnerability manifests during the file parsing process when V-SFT processes macro memory structures. The crafted file exploits improper boundary validation in the get_macro_mem_COM function, causing the application to read beyond allocated memory regions. For detailed technical information, refer to the JVN Security Vulnerability Report and the Fuji Electric Security Advisory.

Detection Methods for CVE-2026-32929

Indicators of Compromise

• Unexpected V7 files appearing in project directories or arriving via email attachments
• V-SFT application crashes or abnormal termination during file opening operations
• Memory access violations or exception events logged during V-SFT file processing
• Unusually sized or malformed V7 files with anomalous macro memory section headers

Detection Strategies

• Deploy endpoint detection and response (EDR) solutions to monitor V-SFT process behavior for memory access anomalies
• Implement file integrity monitoring for V7 project files to detect unauthorized modifications
• Configure application whitelisting to prevent execution of untrusted or modified V-SFT binaries
• Use static analysis tools to scan incoming V7 files for malformed structures before opening

Monitoring Recommendations

• Enable detailed logging for V-SFT application events and file operations
• Monitor for Windows crash reports (WER) involving V-SFT processes with memory access violations
• Implement network monitoring to detect suspicious file downloads targeting HMI engineering workstations
• Configure SIEM rules to alert on patterns of failed file operations in V-SFT environments

How to Mitigate CVE-2026-32929

Immediate Actions Required

• Restrict access to V-SFT engineering workstations to authorized personnel only
• Implement strict file handling policies for V7 files—only open files from trusted sources
• Apply network segmentation to isolate HMI engineering environments from untrusted networks
• Train users to recognize and avoid opening suspicious or unexpected V7 project files

Patch Information

Fuji Electric has released information regarding this vulnerability. Organizations should consult the official Fuji Electric Security Advisory for patch availability and update V-SFT to the latest version that addresses CVE-2026-32929. Additional details are available in the JVN Security Vulnerability Report.

Workarounds

• Only open V7 files that originate from known, trusted sources with verified integrity
• Implement sandboxing or virtual machine isolation when working with untrusted V7 project files
• Disable automatic file association for V7 files to prevent accidental execution
• Deploy application sandboxing solutions that can contain potential memory disclosure impacts

# Configuration example - Restrict V7 file associations (Windows)
# Run as Administrator to remove automatic file association
assoc .v7=
ftype V7File=

# Block V7 files at email gateway if not required
# Example mail server rule (syntax varies by platform)
# Reject or quarantine attachments matching *.v7 pattern