CVE-2024-11957

Arbitrary Code Execution in WPS Office

State: Published
Severity: 9.3 Critical
Published: Mar 4, 2025
Updated: Mar 5, 2025
Reserved: Nov 28, 2024

Description

Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12.1.0.18276

on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.2.0.16909 to mitigate CVE-2024-7262 was not restrictive enough.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H	ESET

Weaknesses

CWE-347 Improper Verification of Cryptographic Signature

Affected Products

Product	Versions
WPS OfficeKingsoft	12.2.0.16909 to before 12.1.0.18276Affected

References

https://www.welivesecurity.com/en/eset-research/analysis-of-two-arbitrary-code-execution-vulnerabilities-affecting-wps-office/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.