TI-2025-02187 Aliases CVE-2025-2516 GHSA-cvv7-5999-m892

Use of a weak cryptographic key in the signature verification process in WPS Office

HIGH 76CWE-326Published 2025-03-27 · Updated 2025-03-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-326.

Summary

The use of a weak cryptographic key pair in the signature verification process in WPS Office (Kingsoft) on Windows allows an attacker who successfully recovered the private key to sign components. As older versions of WPS Office did not validate the update server's certificate, an Adversary-In-The-Middle attack was possible allowing updates to be hijacked.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00141 3rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Kingsoft	WPS Office	—	—	No fix listed	CNA

WPS Office VendorKingsoft Affected — Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-2516
2026-10-03 Alias added: GHSA-cvv7-5999-m892

References

Other 1

https://www.welivesecurity.com/en/eset-research/nspx30-sophisticated-aitm-enabled-implant-evolving-since-2005/

TI-2024-06727 Arbitrary Code Execution in WPS Office KEVCVSS 4.0CRITICAL 9.3
TI-2024-11093 Arbitrary Code Execution in WPS Office CVSS 4.0CRITICAL 9.3
TI-2023-14959 Use of uninitialized resource in WPS Office CVSS 3.1HIGH 8.8
TI-2012-04130 Stack-based buffer overflow in wpsio.dll in Kingsoft WPS Office 2012 possibly 8.1.0.3238… CVSS 2.0HIGH 10.0
TI-2008-01257 Heap-based buffer overflow in the KUpdateObj2 Class ActiveX control in UpdateOcx2.dll in… CVSS 2.0HIGH 10.0
TI-2024-12233 Kingsoft WPS Office TCC code injection CVSS 4.0MEDIUM 4.8

See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences