Vulnerability · Published Mar 27, 2025 · Assigned by ESET
CVE-2025-2516Use of a weak cryptographic key in the signature verification process in WPS Office
Critical 9.5
In plain English
A critical-severity security flaw in WPS Office from Kingsoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
The use of a weak cryptographic key pair in the signature verification process in WPS Office (Kingsoft) on Windows allows an attacker who successfully recovered the private key to sign components. As older versions of WPS Office did not validate the update server's certificate, an Adversary-In-The-Middle attack was possible allowing updates to be hijacked.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kingsoft | WPS Office | see references |
Weakness: CWE-326 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Amber