CVE-2024-11957: Arbitrary Code Execution in WPS Office

Severity: critical (CVSS 9.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-04 · updated 2026-06-17
Weakness: CWE-347

Description

Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12.1.0.18276 on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.2.0.16909 to mitigate CVE-2024-7262 was not restrictive enough.

Affected products

Kingsoft WPS Office: from 12.2.0.16909 before 12.1.0.18276 — fixed in 12.1.0.18276

How to fix

Upgrade to a fixed version: Kingsoft WPS Office 12.1.0.18276. Check the vendor advisory for mitigations.

References

https://www.welivesecurity.com/en/eset-research/analysis-of-two-arbitrary-code-execution-vulnerabilities-affecting-wps-office/

Get alerted when CVE-2024-11957 or the next vulnerability affects your stack