CVE-2024-11957: Arbitrary Code Execution in WPS Office
Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12.1.0.18276
on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.2.0.16909 to mitigate CVE-2024-7262 was not restrictive enough.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11957?
CVE-2024-11957 has a high severity rating due to its potential for arbitrary code execution.
How do I fix CVE-2024-11957?
To mitigate the effects of CVE-2024-11957, upgrade to Kingsoft WPS Office version 12.2.0.16909 or later.
What type of vulnerability is CVE-2024-11957?
CVE-2024-11957 is an improper verification vulnerability that allows for the loading of arbitrary Windows libraries.
Which versions of WPS Office are affected by CVE-2024-11957?
Versions of Kingsoft WPS Office equal to or less than 12.1.0.18276 are affected by CVE-2024-11957.
What can an attacker do with CVE-2024-11957?
An attacker can exploit CVE-2024-11957 to execute arbitrary code on the affected Windows system.