CVE-2024-7263

The promecefpluginhost.exe component improperly validates paths passed as input parameters, enabling a path traversal technique. An attacker can craft an appropriately constructed path that forces the application to load an arbitrary Windows library (DLL). The patch released in version 12.1.0.17119 to fix CVE-2024-7262 was not sufficiently restrictive — one of the parameters was still not properly filtered, leaving an open door for exploitation.

An attacker can achieve arbitrary code execution by loading a malicious DLL library in the context of the WPS Office process, potentially resulting in complete compromise of the victim's system.

Kingsoft WPS Office should be updated to version 12.2.0.17119 or later, in which the vendor released an improved patch addressing the insufficient security measures introduced by the CVE-2024-7262 patch. Details are available at: https://www.wps.com/whatsnew/pc/20240422/

Kingsoft WPS Office versions from 12.2.0.13110 to 12.2.0.17115 (exclusive) on Microsoft Windows