CVE-2025-50130

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A heap-based buffer overflow vulnerability exists in VS6Sim.exe contained in V-SFT and TELLUS provided by FUJI ELECTRIC CO., LTD. Opening V9 files or X1 files specially crafted by an attacker on the affected product may lead to arbitrary code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-50148.8The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path val CVE-2025-50158.8A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS CVE-2025-501518.8File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena vers CVE-2025-501527.8Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2025-501537.8Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally.CVE-2025-501546.5Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over CVE-2025-501557.8Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privile CVE-2025-501565.7Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over CVE-2025-501575.7Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over CVE-2025-501587.0Time-of-check time-of-use (toctou) race condition in Windows NTFS allows an unauthorized attacker to disclose information locally.CVE-2025-501597.3Use after free in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an authorized attacker to elevate privileges locally.CVE-2025-50164.7The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all version