CVE-2024-7262
Kingsoft WPS Office Path Traversal Vulnerability
Description
CVE-2024-7262 is a high-severity arbitrary library loading vulnerability in Kingsoft WPS Office for Windows, affecting versions from 12.2.0.13110 to 12.2.0.16412 (exclusive). The flaw resides in the promecefpluginhost.exe component, which fails to properly validate file paths, allowing an attacker to load an arbitrary Windows DLL. The vulnerability was discovered being weaponized as a single-click exploit delivered through deceptive spreadsheet documents. With an EPSS score of 15.9% (94.6th percentile) and confirmed active exploitation, CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 24, 2024. Organizations using WPS Office should update immediately.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| kingsoft | wps office | >= 12.2.0.13110, < 12.2.0.16412 |
References
- https://www.wps.com/whatsnew/pc/20240422/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7262(US Government Resource)
Weakness Type
Improper Path Validation Leading to Arbitrary Library Loading
Although no formal CWE has been assigned to CVE-2024-7262, the vulnerability is classified as an improper path validation flaw that enables arbitrary Windows library (DLL) loading. The promecefpluginhost.exe component of WPS Office fails to properly validate or sanitize file paths before loading dynamic link libraries, allowing an attacker to specify a path to a malicious DLL that executes within the context of the WPS Office process. This is a form of DLL hijacking or DLL side-loading, where the application's trust in the library loading mechanism is abused to execute attacker-controlled code.
Learn more: CWE-426: Untrusted Search Path
Impact Analysis
The CVSS v3.1 base score of 7.8 (High) reflects a vulnerability that achieves full code execution with user-level privileges. Confidentiality (C:H), integrity (I:H), and availability (A:H) are all fully compromised, as the loaded malicious DLL executes with the same privileges as the WPS Office process, granting the attacker full access to the user's files, credentials, and system resources. The attack requires user interaction — specifically, opening a deceptive spreadsheet document — but no authentication or elevated privileges.
From a business perspective, WPS Office has over 500 million active users worldwide, particularly in Asia-Pacific markets, making this vulnerability relevant to a massive user base. The attack was discovered being used as a weaponized single-click exploit, meaning the attack chain is fully developed and operational. A user simply opens what appears to be a legitimate spreadsheet, and the malicious DLL is loaded and executed without any additional prompts or warnings. The EPSS score of 15.9% at the 94.6th percentile confirms significant real-world exploitation activity. While the ransomware association is listed as unknown, the ability to execute arbitrary code through a document-based delivery mechanism makes this a prime vector for both espionage-focused APT groups and financially motivated ransomware operators.
Exploit Maturity
CVE-2024-7262 was discovered already weaponized as a single-click exploit in the wild, indicating that threat actors developed operational exploit code before the vulnerability was publicly disclosed. This pre-disclosure weaponization resulted in CISA adding the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 24, 2024. The EPSS probability of 15.9% at the 94.6th percentile confirms that this vulnerability ranks among the top 5.4% of all tracked vulnerabilities in terms of exploitation likelihood.
The exploit was delivered through deceptive spreadsheet documents — a social engineering approach that leverages the trust users place in office document formats. When a victim opens the crafted spreadsheet in a vulnerable version of WPS Office, the promecefpluginhost.exe component loads the attacker's malicious DLL without any visible warning. Kingsoft has released a security update addressing the vulnerability. The ransomware status is classified as "Unknown," but the sophistication of the exploit — discovered already weaponized as a single-click attack — suggests involvement by well-resourced threat actors, potentially including nation-state APT groups or advanced cybercriminal organizations.
Remediation
- Update WPS Office to version 12.2.0.16412 or later — Download and install the latest version from the official WPS Office update page. Verify the installed version through Help > About in the WPS Office application.
- Deploy the update across the organization — For enterprise environments, use software deployment tools (SCCM, Intune, or similar) to push the WPS Office update to all endpoints. Ensure automatic updates are enabled in WPS Office settings to receive future patches.
- Block suspicious spreadsheet documents — Configure email gateway and web proxy rules to scan and quarantine spreadsheet files (.xlsx, .xls, .et, .ett) that arrive from external or untrusted sources. Pay particular attention to documents with embedded content or unusual file structures.
- Implement application control policies — Deploy Windows Defender Application Control (WDAC) or AppLocker rules that prevent unsigned or untrusted DLLs from being loaded by WPS Office processes. Specifically, restrict DLL loading to known-safe directories for WPS Office components.
- Monitor for indicators of compromise — Review endpoint detection logs for promecefpluginhost.exe loading DLLs from unexpected locations (user profile directories, temp folders, or document directories). Alert on WPS Office processes spawning unexpected child processes such as PowerShell, cmd.exe, or network connections to unknown external hosts.
Technical Details
The CVSS v3.1 vector for CVE-2024-7262 is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, yielding a base score of 7.8 (High). Attack Vector (AV:L) indicates the attack requires local file interaction, typically triggered by opening a malicious document. Attack Complexity (AC:L) means the exploit works reliably without special conditions. Privileges Required (PR:N) confirms no elevated access is needed. User Interaction (UI:R) requires the victim to open the crafted spreadsheet document. Scope (S:U) limits impact to the WPS Office process context. Confidentiality (C:H), Integrity (I:H), and Availability (A:H) reflect complete compromise of the application and user session.
The vulnerability resides in the promecefpluginhost.exe component, which is part of WPS Office's Chromium Embedded Framework (CEF) plugin infrastructure. This component loads dynamic link libraries (DLLs) based on paths derived from document content or configuration data without performing adequate path validation or integrity checks. An attacker constructs a spreadsheet document that, when processed by WPS Office, triggers the promecefpluginhost.exe component to load a DLL from an attacker-controlled path — either embedded within the document itself, placed in a predictable location alongside the document, or referenced via a network path. The malicious DLL executes within the security context of the WPS Office process, inheriting all permissions of the current user. The fact that this was discovered as a weaponized single-click exploit indicates a mature attack chain with no additional steps required beyond opening the document.
Frequently Asked Questions
What is CVE-2024-7262?
CVE-2024-7262 is an arbitrary library loading vulnerability in Kingsoft WPS Office for Windows that allows attackers to execute malicious code by opening a crafted spreadsheet document. The flaw in the promecefpluginhost.exe component enables loading of untrusted DLLs, and it was discovered already being used as a weaponized single-click exploit.
Which versions of WPS Office are affected?
WPS Office for Windows versions from 12.2.0.13110 up to (but not including) 12.2.0.16412 are affected. Users should update to version 12.2.0.16412 or later to resolve the vulnerability. Only the Windows version of WPS Office is affected.
How is CVE-2024-7262 exploited in practice?
Attackers create a deceptive spreadsheet document that, when opened in a vulnerable version of WPS Office, triggers the loading of a malicious Windows DLL through the promecefpluginhost.exe component. The attack requires only a single click — opening the document — with no additional user interaction needed. The malicious code executes silently in the background.
Is WPS Office safe to use after updating?
Yes, Kingsoft has released version 12.2.0.16412 which addresses this specific vulnerability. After updating, enable automatic updates in WPS Office settings to ensure you receive future security patches promptly. As an additional precaution, exercise caution when opening spreadsheet files from untrusted sources.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.