Kingsoft WPS Office Path Traversal Vulnerability

Technical Severity

CVSS v3.1 Metrics

HIGH

7.8 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitation Likelihood

EPSS Prediction

12.36 %

Predictive Probability

Percentile Rank

93.8 th

Documented as more likely to be exploited than 93.8% of known CVEs.

Detection Date

Sep 03, 2024

Remediation Due

Sep 24, 2024

CISA Catalog Active

Threat Analysis

Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library.

Remediation Directive

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

External Intelligence

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2024-7262