CVE-2026-32926

High

Published: 01 April 2026

Published

01 April 2026

Modified

07 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0001 3.0th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-32926 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Fujielectric V-Sft. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 3.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly requires timely remediation of the out-of-bounds read flaw in V-SFT's VS6ComFile!load_link_inf when processing crafted V7 files.

SI-10 Information Input Validation good match

prevent

Enforces validation of V7 file inputs to prevent malformed files from triggering the out-of-bounds read vulnerability.

SI-16 Memory Protection partial match

prevent

Implements memory protection mechanisms to mitigate information disclosure and impacts from out-of-bounds reads in the vulnerable component.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

T1204.002 Malicious File Execution

An adversary may rely upon a user opening a malicious file in order to gain execution.

attack.mitre.org →

Why these techniques?

OOB read in client-side file parser (V-SFT) is triggered by opening a crafted V7 file, directly enabling client-side exploitation (T1203) that requires user execution of the malicious file (T1204.002).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6ComFile!load_link_inf. Opening a crafted V7 file may lead to information disclosure from the affected product.

Deeper analysisAI

CVE-2026-32926 is an out-of-bounds read vulnerability (CWE-125) in the VS6ComFile!load_link_inf component of V-SFT versions 6.2.10.0 and prior. Published on 2026-04-01, the flaw has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). It occurs when the affected software processes a crafted V7 file, potentially leading to information disclosure from the product.

A local attacker requires no privileges but needs user interaction to exploit the vulnerability, such as convincing the user to open a maliciously crafted V7 file. Successful exploitation can achieve high confidentiality impact via information disclosure, alongside high impacts on integrity and availability.

Mitigation guidance is available in the Fuji Electric advisory at https://felib.fujielectric.co.jp/en/M10010/M20060/document_detail/5d9dd71d-9494-41a4-aa5c-8e6b8b21066b?region=en-glb and the JVN advisory at https://jvn.jp/en/vu/JVNVU90448293/.