CVE-2024-7262

9.3 criticalKEVEPSS 3.1%

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N/RE:L

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 3.1% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2024-09-03, due 2024-09-24
CWE: CWE-22
Published: 2024-08-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

kingsoft:wps_office

References

https://www.wps.com/whatsnew/pc/20240422/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7262

Check your stack JSON