TI-2024-11093 Aliases CVE-2024-11957 GHSA-jxrq-h53g-x3qx

Arbitrary Code Execution in WPS Office

HIGH 75CWE-347Published 2025-03-04 · Updated 2025-03-05

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12.1.0.18276 on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.2.0.16909 to mitigate CVE-2024-7262 was not restrictive enough.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00113 1st percentileScored 2026-11-07

Fix Fixed WPS Office (Kingsoft): 12.1.0.18276

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Kingsoft	WPS Office	12.2.0.16909 to before 12.1.0.18276	12.1.0.18276	Patch available	CNA

WPS Office VendorKingsoft Affected 12.2.0.16909 to before 12.1.0.18276 Fixed in 12.1.0.18276 Patch available CNA

Remediation

Fix · CNA WPS Office (Kingsoft) Fixed in 12.1.0.18276

Timeline

2026-10-02 Threatist record created from CVE-2024-11957
2026-10-03 Alias added: GHSA-jxrq-h53g-x3qx

References

Other 1

https://www.welivesecurity.com/en/eset-research/analysis-of-two-arbitrary-code-execution-vulnerabilities-affecting-wps-office/

TI-2024-06727 Arbitrary Code Execution in WPS Office KEVCVSS 4.0CRITICAL 9.3
TI-2025-02187 Use of a weak cryptographic key in the signature verification process in WPS Office CVSS 4.0CRITICAL 9.5
TI-2023-14959 Use of uninitialized resource in WPS Office CVSS 3.1HIGH 8.8
TI-2012-04130 Stack-based buffer overflow in wpsio.dll in Kingsoft WPS Office 2012 possibly 8.1.0.3238… CVSS 2.0HIGH 10.0
TI-2008-01257 Heap-based buffer overflow in the KUpdateObj2 Class ActiveX control in UpdateOcx2.dll in… CVSS 2.0HIGH 10.0
TI-2024-12233 Kingsoft WPS Office TCC code injection CVSS 4.0MEDIUM 4.8

See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences