CVE-2026-32927

High

Published: 01 April 2026

Published

01 April 2026

Modified

07 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0001 3.0th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-32927 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Fujielectric V-Sft. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 3.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Malicious File (T1204.002). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the out-of-bounds read vulnerability by requiring timely patching of V-SFT software as specified in vendor advisories.

SI-16 Memory Protection good match

prevent

Implements runtime memory protections such as address space layout randomization and stack guards to prevent exploitation of the out-of-bounds read in VS6MemInIF!set_temp_type_default.

SI-10 Information Input Validation partial match

prevent

Requires validation of crafted V7 file inputs to block malformed data that triggers the out-of-bounds read during parsing.

MITRE ATT&CK Enterprise TechniquesAI

T1204.002 Malicious File Execution

An adversary may rely upon a user opening a malicious file in order to gain execution.

attack.mitre.org →

Why these techniques?

Vulnerability is triggered by a user opening a crafted malicious V7 file in V-SFT, directly mapping to user execution via malicious file delivery.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information disclosure from the affected product.

Deeper analysisAI

CVE-2026-32927 is an out-of-bounds read vulnerability (CWE-125) in the VS6MemInIF!set_temp_type_default component of V-SFT software versions 6.2.10.0 and prior. The issue arises when opening a crafted V7 file, potentially leading to information disclosure from the affected product. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity with impacts on confidentiality, integrity, and availability.

A local attacker with no privileges can exploit this vulnerability by tricking a user into opening a maliciously crafted V7 file through the V-SFT application. Successful exploitation requires user interaction but low complexity, allowing the attacker to disclose sensitive information and potentially cause integrity and availability disruptions on the local system.

Mitigation details are available in advisories from Fuji Electric at https://felib.fujielectric.co.jp/en/M10010/M20060/document_detail/5d9dd71d-9494-41a4-aa5c-8e6b8b21066b?region=en-glb and JVN at https://jvn.jp/en/vu/JVNVU90448293/, which published on 2026-04-01. Security practitioners should consult these for patching instructions and workarounds specific to V-SFT deployments.