Read the docs
TI-2024-06727 Aliases CVE-2024-7262GHSA-p736-fp6q-qr5j

Arbitrary Code Execution in WPS Office

Priority CRITICAL 99Exploited in the wildCWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document

Why it matters now

Exploitation Active In CISA KEV since 2024-09-03CISA due date 2024-09-24
EPSS 0.03058 87th percentileScored 2026-11-07
Fix Fixed WPS Office (Kingsoft): 12.2.0.16412

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KingsoftWPS Office12.2.0.13110 to before 12.2.0.1641212.2.0.16412Patch availableCNA
  • WPS Office VendorKingsoft Affected 12.2.0.13110 to before 12.2.0.16412 Fixed in 12.2.0.16412 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:kingsoft:wps_office:*:*:*:*:*:*:*:*12.2.0.13110 to before 12.2.0.16412VulnerableKingsoft
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:kingsoft:wps_office:*:*:*:*:*:*:*:* Versions 12.2.0.13110 to before 12.2.0.16412 Vulnerable ·Kingsoft
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA WPS Office (Kingsoft) Fixed in 12.2.0.16412

Timeline

  1. 2024-09-03 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2024-7262
  3. 2026-10-03 Alias added: GHSA-p736-fp6q-qr5j

References

Advisory 1

  • TI-2023-14959 Use of uninitialized resource in WPS Office CVSS 3.1HIGH 8.8
  • TI-2024-06728 Arbitrary Code Execution in WPS Office CVSS 4.0CRITICAL 9.3
  • TI-2023-15830 OS command injection in Kingsoft WPS Office CVSS 3.1HIGH 8.1
  • TI-2020-15522 GdiDrawHoriLineIAlt in Kingsoft WPS Office before 11.2.0.9403 allows remote heap… CVSS 3.1HIGH 7.8
  • TI-2022-09548 Uncontrolled search path in Kingsoft The installer of WPS Office CVSS 3.1HIGH 7.8
  • TI-2022-09491 Uncontrolled search path in Kingsoft The installer of WPS Office CVSS 3.1HIGH 7.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences