CVE-2024-7262: critical vulnerability in Kingsoft WPS Office
Arbitrary Code Execution in WPS Office
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
WPS Office has a flaw that lets attackers run harmful code by tricking users into opening a specially crafted spreadsheet file. This happens because the application doesn't properly check file paths before loading libraries, allowing attackers to substitute legitimate files with malicious ones.
Path traversal vulnerability in promecefpluginhost.exe (WPS Office 12.2.0.13110 to 12.2.0.16412) allows arbitrary DLL loading through improper validation of library paths. Attack vector is user interaction via deceptive document delivery; exploitation results in arbitrary code execution with user privileges. Weaponized exploits demonstrate single-click compromise of affected systems.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.