{"id":"CVE-2024-7262","kind":"vulnerability","aliases":["CVE-2024-7262"],"related":[],"title":"Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to…","description":"Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library.\nThe vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document","summary":"Kingsoft WPS Office on Windows has a path traversal flaw in promecefpluginhost.exe that lets an attacker load an arbitrary Windows library. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.3,"epss":null,"exploited":true,"exploited_at":"2024-09-03T00:00:00+00:00","products":[{"name":"kingsoft wps office","fixed":["12.2.0.16412"],"affected":">= 12.2.0.13110, < 12.2.0.16412","ecosystem":"vendor"},{"name":"Kingsoft WPS Office","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","other","windows","wps-office"],"not_affected_if":["wps-office-not-installed"],"how_to_check":null,"fix":"Apply mitigations per vendor instructions, or stop using WPS Office if mitigations are unavailable (CISA required action). Fixed version: unknown","status":"open","published_at":"2024-08-15T15:15:22+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:16+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T20:58:16Z","model":"claude-haiku-5-5","output":{"fix":"Apply mitigations per vendor instructions, or stop using WPS Office if mitigations are unavailable (CISA required action). Fixed version: unknown","reach":"local","impact":"high","summary":"Kingsoft WPS Office on Windows has a path traversal flaw in promecefpluginhost.exe that lets an attacker load an arbitrary Windows library. CISA lists it as actively exploited in the wild.","category":"other","who_cares":["windows","wps-office"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker loads arbitrary library, running attacker code on the Windows machine","analyst_note":"Find the vendor advisory from Kingsoft and the fixed WPS Office build number, plus the exploitation vector (local file or remote delivery) and any detection guidance.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["wps-office-not-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000465,"input_tokens":2825,"output_tokens":364,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':15A,18A '-7262':16A,19A '12.2.0.13110':13A,74C '12.2.0.16412':76C 'activ':57B 'allow':80C 'arbitrari':50B,86C 'attack':47B,82C 'cisa':53B 'click':98C 'cve':14A,17A 'decept':105C 'document':107C 'exclus':77C 'exploit':26B,58B,99C 'flaw':41B 'form':102C 'found':92C 'improp':1A,62C 'kingsoft':7A,20A,23A,32B,68C 'let':45B 'librari':52B,88C 'list':54B 'load':48B,84C 'offic':9A,31B,34B,70C 'office':22A,25A 'path':2A,39B,63C 'promecefpluginhost.exe':5A,43B,66C 'rang':11A,72C 'singl':97C 'single-click':96C 'spreadsheet':106C 'travers':40B 'valid':3A,64C 'version':10A,71C 'vulner':90C 'weapon':93C 'wild':61B 'window':28B,36B,51B,79C,87C 'wps':8A,21A,24A,30B,33B,69C 'wps-offic':29B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-08-15T15:15:22+00:00","kev":{"dateAdded":"2024-09-03","dueDate":"2024-09-24","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:X","cvss_by":"security@eset.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-7262","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7262","severity":null,"published_at":"2024-09-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-7262","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7262","severity":null,"published_at":"2024-08-15T15:15:22+00:00","modified_at":"2026-06-17T08:19:43+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}