CVE-2024-7262Arbitrary Code Execution in WPS Office

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document

9.3 CRITICALEPSS 3.05%⚡ Known Exploited (CISA KEV)NVD: Published

Last updated: 2025-10-21 22:55 UTC

OverviewCVSS details

9.3CRITICALCVSS 4.0

Score source: ESET (CNA)
NVD status: Published
Published: Aug 15, 2024
Assigner: ESET

Affected

WPS Office (Kingsoft)

Versions: 12.2.0.13110 before 12.2.0.16412
Fixed in: 12.2.0.16412

Exploitation

Public exploit: None listed
CISA KEV: Listed · Sep 3, 2024
KEV due date: Sep 24, 2024
Ransomware use: Unknown
SSVC: Exploitation active · Automatable no · Impact total

EPSS · FIRST, scored Nov 7

3.05%chance of exploitation in 30 days

Higher than 87.67% of CVEs

CVSS 4.0 · ESET (CNA)

9.3Critical

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N/RE:L

Attack vector: Local
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: Passive
Confidentiality impact: High
Integrity impact: High
Availability impact: High
Confidentiality (other systems): High
Integrity (other systems): High
Availability (other systems): High

NVD status: Published

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.3	CRITICAL	4.0ESET (CNA)	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N/RE:L

Details

CVE ID: CVE-2024-7262
Status: Published
Assigner (CNA): ESET
Published: Aug 15, 2024
Last modified: 2025-10-21 22:55 UTC
Weaknesses: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory

Sources

NVD (unavailable at last refresh)
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-07 15:44 UTC.