CVE-2024-7262 - Arbitrary Code Execution in WPS Office

Back Back to CVE browser

CRITICAL KEV

Arbitrary Code Execution in WPS Office

Published Aug 15, 2024 ·Due Sep 24, 2024

9.3

CRITICAL

CVSS 4.0

EPSS 2.94%

Description

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document

Affected products

Vendor Kingsoft Product WPS Office Default
n/a
- Version
  12.2.0.13110
  Status
  affected
  Constraints
  <12.2.0.16412

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Kingsoft

WPS Office

n/a

Version	Status	Constraints
12.2.0.13110	affected	<12.2.0.16412

Vendor Kingsoft Product Wps Office Default
n/a
- Version
  12.2.0.13110
  Status
  affected
  Constraints
  <12.2.0.13489

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Kingsoft

Wps Office

n/a

Version	Status	Constraints
12.2.0.13110	affected	<12.2.0.13489

Remediation

Vendor solution

Update to latest version

Weaknesses (1)

CWE-22

Path Traversal

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48209
Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7262
government-resourceUS Government Resource
https://www.wps.com/whatsnew/pc/20240422/
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48209		Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7262		government-resourceUS Government Resource
https://www.wps.com/whatsnew/pc/20240422/		Vendor Advisory