Heap-based buffer overflow in Fuji Electric V-SFT-6
Priority LOW 38CWE-122Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.
Summary
A heap-based buffer overflow vulnerability exists in VS6Sim.exe contained in V-SFT and TELLUS provided by FUJI ELECTRIC CO., LTD. Opening V9 files or X1 files specially crafted by an attacker on the affected product may lead to arbitrary code execution.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00231 13th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Fuji Electric | V-SFT-6 | up to v6.2.5.0 | — | No fix listed | CNA |
| Fuji Electric | TELLUS | up to v4.0.20.0 | — | No fix listed | CNA |
- V-SFT-6 VendorFuji Electric Affected up to v6.2.5.0 Fixed in — No fix listed CNA
- TELLUS VendorFuji Electric Affected up to v4.0.20.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-50130
- 2026-10-03 Alias added: GHSA-pcgw-3wcr-fcj5
References
More Fuji Electric vulnerabilities
- TI-2019-13257 Heap-based buffer overflow in Fuji Electric V-Server 4.0.6 and prior CVSS 3.1CRITICAL 9.8
- TI-2018-10620 Out-of-bounds read in Fuji Electric FRENIC LOADER of FRENIC-Mini , FRENIC-Mini… CVSS 3.0CRITICAL 9.8
- TI-2018-10653 Stack-based buffer overflow in Fuji Electric V-Server CVSS 3.1CRITICAL 9.8
- TI-2018-10643 Heap-based buffer overflow in Fuji Electric V-Server CVSS 3.1CRITICAL 9.8
- TI-2018-03956 Stack-based buffer overflow in Fuji Electric V-Server VPR CVSS 3.1CRITICAL 9.8
- TI-2018-10649 Out-of-bounds read in Fuji Electric V-Server CVSS 3.0CRITICAL 9.8
Sources
- CVE-2025-50130 · CVE Program
- CVE-2025-50130 · NVD
- FIRST EPSS
- GHSA-pcgw-3wcr-fcj5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences