CVE-2024-7262

The flaw lies in improper path validation in the promecefpluginhost.exe executable that is part of Kingsoft WPS Office. An attacker can provide the victim with a malicious spreadsheet document, which when opened (single click) causes the application to load any DLL library specified by the attacker. The path traversal mechanism allows bypassing the allowed directory and specifying a library located in any accessible location on the system or network.

An attacker can achieve arbitrary code execution in the context of the WPS Office process by loading a malicious Windows library, which in practice can result in complete takeover of the victim's system.

Kingsoft WPS Office should be updated to version 12.2.0.16412 or newer. Detailed information about the patch is available in the vendor's references at https://www.wps.com/whatsnew/pc/20240422/

Kingsoft WPS Office versions from 12.2.0.13110 to 12.2.0.16412 (exclusive) running on Microsoft Windows system.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library.