CVE-2026-32926
Published: 01 April 2026
Summary
CVE-2026-32926 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Fujielectric V-Sft. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 8.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-32926 is an out-of-bounds read vulnerability (CWE-125) in the VS6ComFile!load_link_inf component of V-SFT versions 6.2.10.0 and prior. Published on 2026-04-01, the flaw has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). It occurs when the affected software processes a crafted V7 file, potentially leading to information disclosure from the product.
A local attacker requires no privileges but needs user interaction to exploit the vulnerability, such as convincing the user to open a maliciously crafted V7 file. Successful exploitation can achieve high confidentiality impact via information disclosure, alongside high impacts on integrity and availability.
Mitigation guidance is available in the Fuji Electric advisory at https://felib.fujielectric.co.jp/en/M10010/M20060/document_detail/5d9dd71d-9494-41a4-aa5c-8e6b8b21066b?region=en-glb and the JVN advisory at https://jvn.jp/en/vu/JVNVU90448293/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18100
Vulnerability details
V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6ComFile!load_link_inf. Opening a crafted V7 file may lead to information disclosure from the affected product.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB read in client-side file parser (V-SFT) is triggered by opening a crafted V7 file, directly enabling client-side exploitation (T1203) that requires user execution of the malicious file (T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the out-of-bounds read flaw in V-SFT's VS6ComFile!load_link_inf when processing crafted V7 files.
Enforces validation of V7 file inputs to prevent malformed files from triggering the out-of-bounds read vulnerability.
Implements memory protection mechanisms to mitigate information disclosure and impacts from out-of-bounds reads in the vulnerable component.