CVE-2026-32928 is a stack-based buffer overflow vulnerability in the V-SFT product by FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd., affecting versions 6.2.10.0 and earlier. The issue arises in the VS6ComFile!CSaveData::_conv_AnimationItem function when processing V7 files. Exploitation requires opening a crafted V7 file, which may allow an attacker to execute arbitrary code with the privileges of the user running the application. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, but user interaction needed. Confidentiality, integrity, and availability impacts are all rated high. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability can lead to arbitrary code execution on the affected system, potentially allowing an attacker to compromise confidentiality, integrity, and availability of the system. The attack requires local access and user interaction (opening a malicious file). No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should avoid opening untrusted or suspicious V7 files with affected versions of V-SFT. Monitor vendor communications for updates on patches or mitigations.