Vulnerability · Published Mar 4, 2025 · Assigned by ESET
CVE-2024-11957Arbitrary Code Execution in WPS Office
Critical 9.3
In plain English
A critical-severity security flaw in WPS Office from Kingsoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.1%top 98.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12.1.0.18276 on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.2.0.16909 to mitigate CVE-2024-7262 was not restrictive enough.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kingsoft | WPS Office | 12.2.0.16909 – before 12.1.0.18276 |
Weakness: CWE-347 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H