[Japanese]

JVNDB-2025-005107

Multiple vulnerabilities in V-SFT

Overview

V-SFT provided by FUJI ELECTRIC CO., LTD. contains multiple vulnerabilities listed below.



  • Free of Pointer not at Start of Buffer in VS6EditData.dll!CWinFontInf::WinFontMsgCheck function (CWE-761)

    • CVE-2025-47749


  • Out-of-bounds Write in VS6MemInIF!set_temp_type_default function (CWE-787)

    • CVE-2025-47750


  • Out-of-bounds Write in VS6MemInIF!set_temp_type_default function (CWE-787)

    • CVE-2025-47751


  • Out-of-bounds Write in VS6ComFile!MakeItemGlidZahyou function (CWE-787)

    • CVE-2025-47752


  • Out-of-bounds Read in VS6EditData!CDrawSLine::GetRectArea function(CWE-125)

    • CVE-2025-47753


  • Out-of-bounds Read in VS6EditData!Conv_Macro_Data function (CWE-125)

    • CVE-2025-47754


  • Out-of-bounds Read in VS6EditData!VS4_SaveEnvFile function (CWE-125)

    • CVE-2025-47755


  • Out-of-bounds Read in VS6EditData!CGamenDataRom::set_mr400_strc function (CWE-125)

    • CVE-2025-47756


  • Out-of-bounds Read in VS6MemInIF.dll!set_plc_type_default function (CWE-125)

    • CVE-2025-47757


  • Stack-based Buffer Overflow in VS6File!CTxSubFile::get_ProgramFile_name function (CWE-121)

    • CVE-2025-47758


  • Stack-based Buffer Overflow in VS6ComFile!CV7BaseMap::WriteV7DataToRom function (CWE-121)

    • CVE-2025-47759


  • Stack-based Buffer Overflow in VS6MemInIF!set_temp_type_default function (CWE-121)

    • CVE-2025-47760



Michael Heinzl reported these vulnerabilities to JPCERT/CC.
JPCERT/CC coordinated with the developer.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
The above CVSS base scores have been assigned for CVE-2025-47749

CVSS V3 Severity:
Base Metrics7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
The above CVSS base scores have been assigned for CVE-2025-47750

CVSS V3 Severity:
Base Metrics7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
The above CVSS base scores have been assigned for CVE-2025-47751

CVSS V3 Severity:
Base Metrics7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
The above CVSS base scores have been assigned for CVE-2025-47752

CVSS V3 Severity:
Base Metrics7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
The above CVSS base scores have been assigned for CVE-2025-47753

CVSS V3 Severity:
Base Metrics7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
The above CVSS base scores have been assigned for CVE-2025-47754

CVSS V3 Severity:
Base Metrics7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
The above CVSS base scores have been assigned for CVE-2025-47755

CVSS V3 Severity:
Base Metrics7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
The above CVSS base scores have been assigned for CVE-2025-47756

CVSS V3 Severity:
Base Metrics7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
The above CVSS base scores have been assigned for CVE-2025-47757

CVSS V3 Severity:
Base Metrics7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
The above CVSS base scores have been assigned for CVE-2025-47758

CVSS V3 Severity:
Base Metrics7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
The above CVSS base scores have been assigned for CVE-2025-47759

CVSS V3 Severity:
Base Metrics7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
The above CVSS base scores have been assigned for CVE-2025-47760
Affected Products


Fuji Electric Co., Ltd.
  • V-SFT-6 v6.2.5.0 and earlier

Impact

Opening specially crafted V7 files or V8 files may lead to the following impacts:

  • Affected system's abnormal end (ABEND)

  • Information disclosure

  • Arbitrary code execution

Solution

[Update the software]
Update the software to the latest version according to the information provided by the developer.
Vendor Information

Fuji Electric Co., Ltd.
CWE (What is CWE?)

  1. Stack-based Buffer Overflow(CWE-121) [Other]
  2. Out-of-bounds Read(CWE-125) [Other]
  3. Free of Pointer not at Start of Buffer(CWE-761) [Other]
  4. Out-of-bounds Write(CWE-787) [Other]
CVE (What is CVE?)

  1. CVE-2025-47749
  2. CVE-2025-47750
  3. CVE-2025-47751
  4. CVE-2025-47752
  5. CVE-2025-47753
  6. CVE-2025-47754
  7. CVE-2025-47755
  8. CVE-2025-47756
  9. CVE-2025-47757
  10. CVE-2025-47758
  11. CVE-2025-47759
  12. CVE-2025-47760
References

  1. JVN : JVNVU#97228144
Revision History

  • [2025/05/16]
      Web page was published

Date Public2025/05/14
Date First Published2025/05/16
Date Last Updated2025/05/16