CVE-2024-7262

Description

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 9.3CVSS 4.0, Criticalfrom the CNA (ESET)CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N/RE:L

What to do

• Update to latest versionCNA solution statement
• Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-17: Using Malicious Files (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 15 Aug 2024 Published
2. 3 Sep 2024 CVE-2024-7262 added to CISA KEV
3. 3 Sep 2024 Added to the CISA KEV catalogue

Weakness

• CWE-22

References

• www.wps.com