CVE-2026-32928
Published: 01 April 2026
Summary
CVE-2026-32928 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Fujielectric V-Sft. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 11.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-32928 is a stack-based buffer overflow vulnerability (CWE-121) in V-SFT versions 6.2.10.0 and prior. The flaw exists in the VS6ComFile!CSaveData::_conv_AnimationItem component. It is triggered when opening a crafted V7 file, which may lead to arbitrary code execution on the affected product.
The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). A local attacker with low complexity can exploit it by tricking a user into opening a malicious V7 file, requiring no privileges. Successful exploitation enables arbitrary code execution, resulting in high impacts to confidentiality, integrity, and availability on the local system.
Advisories published by Fuji Electric (https://felib.fujielectric.co.jp/en/M10010/M20060/document_detail/5d9dd71d-9494-41a4-aa5c-8e6b8b21066b?region=en-glb) and JVN (https://jvn.jp/en/vu/JVNVU90448293/) provide further details on mitigation, including any available patches or workarounds for affected V-SFT installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18104
Vulnerability details
V-SFT versions 6.2.10.0 and prior contain a stack-based buffer overflow in VS6ComFile!CSaveData::_conv_AnimationItem. Opening a crafted V7 file may lead to arbitrary code execution on the affected product.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in V-SFT file parser (VS6ComFile!CSaveData::_conv_AnimationItem) enables RCE on opening a crafted V7 file; directly maps to client-side exploitation triggered by user opening malicious file (T1203 + T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the stack-based buffer overflow by identifying, reporting, and applying vendor patches for the specific flaw in V-SFT versions 6.2.10.0 and prior.
Implements memory safeguards such as stack canaries, ASLR, and DEP to prevent arbitrary code execution from the stack buffer overflow triggered by crafted V7 files.
Requires validation of V7 file inputs to the VS6ComFile!CSaveData::_conv_AnimationItem component, addressing malformed data that causes the buffer overflow.