Read the docs
TI-2022-09482 Aliases CVE-2022-25943GHSA-q9cp-6576-r6r7

Incorrect default permissions in WPS Office for Windows

Priority LOW 35CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the service program is installed.

Why it matters now

EPSS 0.00716 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WPS Office for Windows (WPS Office Software): v11.2.0.10258

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
WPS Office SoftwareWPS Office for Windowsbefore v11.2.0.10258v11.2.0.10258Patch availableCNA
  • WPS Office for Windows VendorWPS Office Software Affected before v11.2.0.10258 Fixed in v11.2.0.10258 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kingsoft:wps_office:*:*:*:*:*:windows:*:*before 11.2.0.10258VulnerableKingsoft
  • cpe:2.3:a:kingsoft:wps_office:*:*:*:*:*:windows:*:* Versions before 11.2.0.10258 Vulnerable ·Kingsoft

Remediation

  • Fix · CNA WPS Office for Windows (WPS Office Software) Fixed in v11.2.0.10258

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-25943
  2. 2026-10-03 Alias added: GHSA-q9cp-6576-r6r7

References

Exploit 1

Advisory 1

Other 1

  • TI-2024-06727 Arbitrary Code Execution in WPS Office KEVCVSS 4.0CRITICAL 9.3
  • TI-2023-14959 Use of uninitialized resource in WPS Office CVSS 3.1HIGH 8.8
  • TI-2024-06728 Arbitrary Code Execution in WPS Office CVSS 4.0CRITICAL 9.3
  • TI-2023-15830 OS command injection in Kingsoft WPS Office CVSS 3.1HIGH 8.1
  • TI-2020-15522 GdiDrawHoriLineIAlt in Kingsoft WPS Office before 11.2.0.9403 allows remote heap… CVSS 3.1HIGH 7.8
  • TI-2022-09548 Uncontrolled search path in Kingsoft The installer of WPS Office CVSS 3.1HIGH 7.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences