CVE-2024-7262

HIGHCISA KEV

7.8

Descripcion

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document

Detalles CVE

Puntuacion CVSS v3.17.8

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vector de ataqueLOCAL

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado8/15/2024

Ultima modificacion10/30/2025

Fuentekev

Avistamientos honeypot0

CISA KEV

VendedorKingsoft

ProductoWPS Office

Nombre vulnerabilidadKingsoft WPS Office Path Traversal Vulnerability

Fecha inclusion KEV2024-09-03

Fecha limite remediacion2024-09-24

Uso en ransomwareUnknown

Productos afectados

kingsoft:wps_officemicrosoft:windows

Debilidades (CWE)

CWE-22CWE-22

Referencias

https://www.wps.com/whatsnew/pc/20240422/(security@eset.com)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7262(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.