PT-2022-3353 · V-Sft · V-Sft

Michael Heinzl · Published 2022-04-07 · Updated 2022-06-27 · CVE-2022-26302

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions V-SFT versions prior to v6.1.6.0

Description A heap-based buffer overflow exists in the simulator module of the graphic editor V-SFT, which may allow an attacker to obtain information and/or execute arbitrary code by having a user open a specially crafted image file. This issue is related to the graphic editor's ability to handle image files, potentially allowing unauthorized access to protected information or the execution of arbitrary code.

Recommendations For versions prior to v6.1.6.0, update to version v6.1.6.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the simulator module in V-SFT until a patch is applied. Avoid opening specially crafted image files with the affected software to minimize the risk of exploitation.

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2022-04111

CVE-2022-26302

Affected Products

V-Sft

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-26302 · Security Note
• https://bdu.fstec.ru/vul/2022-04111 · Security Note
• https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26302 · Vendor Advisory
• https://jvn.jp/en/vu/JVNVU99188133/index.html · Note
• https://t.me/cvenotify/31573 · Telegram Post