CVE-2024-11957CWE-347

Arbitrary Code Execution in WPS Office

Critical · published March 4, 2025

CVSS v4.0
9.3
EPSS
0%
Percentile
1.4
In the wild
Unconfirmed
What it is

Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12.1.0.18276

on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.2.0.16909 to mitigate CVE-2024-7262 was not restrictive enough.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H
EPSS
0.00113 · 1.4th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2025-03-04T15:41Z
EPSS history
Timeline
  • 04 MAR 15:41Z
    Arbitrary Code Execution in WPS Office
    cvelistv5