Kingsoft · WPS Office

CVE-2024-7262

Arbitrary Code Execution in WPS Office

Exploited in attacks Critical 9.3 Attack chance: 3.1%

What it is

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library.
The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document

CISA: Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: September 24, 2024

Added to the CISA list: September 3, 2024
Published: August 15, 2024
Severity: Critical 9.3 CVSS 4.0
Chance of attacks in the next 30 days (EPSS): 3.1% in the top 12.5% of all known vulnerabilities
Weakness: CWE-22
More details: NVD · CVE.org · CISA

All references (1)

https://www.wps.com/whatsnew/pc/20240422/

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.