CVE-2024-7262: Kingsoft WPS Office Path Traversal Vulnerability
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document
Other sources
Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Discontinue use of Kingsoft WPS Office if vendor mitigations are unavailable.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7262?
CVE-2024-7262 is considered a critical vulnerability due to its potential for an attacker to load arbitrary libraries.
How can I fix CVE-2024-7262?
To fix CVE-2024-7262, update Kingsoft WPS Office to a version newer than 12.2.0.16412.
Which versions of Kingsoft WPS Office are affected by CVE-2024-7262?
CVE-2024-7262 affects Kingsoft WPS Office versions from 12.2.0.13110 to 12.2.0.16412 (exclusive).
What type of attack does CVE-2024-7262 facilitate?
CVE-2024-7262 allows attackers to exploit improper path validation to load arbitrary Windows libraries.
Is CVE-2024-7262 specific to certain operating systems?
CVE-2024-7262 is specifically a vulnerability identified in software running on Microsoft Windows.