CVE-2025-2516: Use of a weak cryptographic key in the signature verification process in WPS Office
First published: Thu Mar 27 2025(Updated: )
The use of a weak cryptographic key pair in the signature verification process in WPS Office (Kingsoft) on Windows allows an attacker who successfully recovered the private key to sign components. As older versions of WPS Office did not validate the update server's certificate, an Adversary-In-The-Middle attack was possible allowing updates to be hijacked.
Credit: security@eset.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WPS Office |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-2516?
CVE-2025-2516 is considered a high severity vulnerability due to its potential for exploitation through weak cryptographic key management.
How does CVE-2025-2516 affect WPS Office users?
CVE-2025-2516 affects WPS Office users by allowing attackers to sign malicious components if they recover the private key from the weak cryptographic key pair.
How can I mitigate the risks associated with CVE-2025-2516?
To mitigate CVE-2025-2516, users should update to the latest version of WPS Office which addresses the weak cryptographic key issue.
Is there a patch available for CVE-2025-2516?
Yes, a patch for CVE-2025-2516 is available in the latest updates of WPS Office that strengthens the signature verification process.
What system versions are affected by CVE-2025-2516?
CVE-2025-2516 affects older versions of WPS Office on Windows that utilize weak cryptographic practices.
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/severity
- agent/title
- agent/source
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/kingsoft
- canonical/wps office