VULNERABILITY INTELLIGENCE

CVE-2024-7262

CVSS score9.3 CRITICAL
EPSS probability3.06%
CISA KEVKnown exploited vulnerability
Published2024-08-15
Last modified2026-06-17
CVSS vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:X

Known Exploited Vulnerability

Kingsoft WPS Office Path Traversal Vulnerability

Vendor / product: Kingsoft / WPS Office

Description

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document

Weakness classification

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references