# CVE-2026-107894: Fuji Electric V-SFT stack-based buffer overflow

Source: https://junglewise.ai/threats/cve-2026-107894-v-sft-provided-by-fuji-electric-co-ltd-contains-a-stack-based  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-107894 · Severity: high · CVSS 7.8 · Published 2026-10-26

V-SFT is an industrial software platform used to configure and manage Fuji Electric control systems and human-machine interfaces. A stack-based buffer overflow vulnerability in V-SFT can be triggered by opening a specially crafted V7 file, potentially allowing an attacker to execute arbitrary code or expose sensitive information on the affected system.

Technologies: [Fuji Electric V-SFT](https://junglewise.ai/threats/technologies/fuji-electric-v-sft). Vendors: [Fuji Electric](https://junglewise.ai/threats/vendors/fuji-electric).

## Quick answers

**Is CVE-2026-107894 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107894 being exploited in the wild.

**How severe is CVE-2026-107894?** High severity, with a CVSS score of 7.8, published 26 October 2026.

**Which products and versions are affected?** Fuji Electric V-SFT 6.2.11.0 and prior.

**Is there a fix for CVE-2026-107894?** Yes: fixed in V-SFT 6.2.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107894 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-107894?** Check whether you run Fuji Electric V-SFT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in V-SFT 6.2.12.0

## Technical details

Stack-based buffer overflow (CWE-121) in V-SFT triggered by parsing a specially crafted V7 project file. The vulnerability requires local access and user interaction (opening the malicious file) but no authentication. Successful exploitation can lead to arbitrary code execution with the privileges of the user running V-SFT.

## Affected products

- Fuji Electric V-SFT 6.2.11.0 and prior

## Timeline

- 2026-10-26: disclosed
- 2026-10-26: advisory

## References

- [https://felib.fujielectric.co.jp/en/M10010/M20060/document_detail/5d9dd71d-9494-41a4-aa5c-8e6b8b21066b?region=en-glb](https://felib.fujielectric.co.jp/en/M10010/M20060/document_detail/5d9dd71d-9494-41a4-aa5c-8e6b8b21066b?region=en-glb)
- [https://jvn.jp/en/vu/JVNVU96549652/](https://jvn.jp/en/vu/JVNVU96549652/)

## Related threats

- [Fuji Electric V-SFT out-of-bounds read in VS6ComFile ItemCheck](https://junglewise.ai/threats/cve-2026-107900-v-sft-provided-by-fuji-electric-co-ltd-contains-an-out-of-bounds)
- [Fuji Electric V-SFT out-of-bounds read in macro parameter validation](https://junglewise.ai/threats/cve-2026-107899-v-sft-provided-by-fuji-electric-co-ltd-contains-an-out-of-bounds)
- [Fuji Electric V-SFT out-of-bounds read in macro command check](https://junglewise.ai/threats/cve-2026-107898-v-sft-provided-by-fuji-electric-co-ltd-contains-an-out-of-bounds)
- [Fuji Electric V-SFT out-of-bounds read in VS6MemInIF](https://junglewise.ai/threats/cve-2026-107897-v-sft-provided-by-fuji-electric-co-ltd-contains-an-out-of-bounds)
- [Fuji Electric V-SFT out-of-bounds read in VS6ComFile load_gr_item](https://junglewise.ai/threats/cve-2026-107896-v-sft-provided-by-fuji-electric-co-ltd-contains-an-out-of-bounds)