What’s Vulnerable › Vulnerabilities
CVE-2024-7263: Arbitrary Code Execution in WPS Office
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-08-15 · updated 2026-06-17
- Weakness: CWE-22
Description
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.1.0.17119 to mitigate CVE-2024-7262 was not restrictive enough. Another parameter was not properly sanitized which leads to the execution of an arbitrary Windows library.
Affected products
- Kingsoft WPS Office: from 12.2.0.13110 before 12.2.0.17153 — fixed in 12.2.0.17153
How to fix
Upgrade to a fixed version: Kingsoft WPS Office 12.2.0.17153. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-7263 or the next vulnerability affects your stack