Critical Path Traversal Vulnerability Discovered in Kingsoft WPS Office

What changed

A newly identified path traversal vulnerability in Kingsoft WPS Office has been reported, affecting versions 12.2.0.13110 to 12.2.0.16412 (exclusive). This flaw arises from improper path validation in the promecefpluginhost.exe component, enabling attackers to load arbitrary Windows libraries.

The vulnerability has been weaponized into a single-click exploit, which can be delivered through deceptive spreadsheet documents, increasing the risk of exploitation.

Who is affected

The vulnerability impacts a wide range of users of Kingsoft WPS Office, particularly those utilizing the affected versions on Windows systems.

Organizations relying on this software for document processing should be particularly vigilant.

• Users of Kingsoft WPS Office versions 12.2.0.13110 to 12.2.0.16412.
• Businesses that integrate WPS Office into their workflows.
• Individuals handling sensitive information through WPS Office documents.
• IT departments managing software updates and security for Windows environments.

What to do

It is crucial for users and organizations to assess their current version of Kingsoft WPS Office and apply necessary updates or patches as soon as they become available.

Additionally, users should exercise caution when opening documents from untrusted sources to mitigate the risk of exploitation.

• Verify the version of Kingsoft WPS Office in use and plan for an upgrade if necessary.
• Implement strict email and document handling policies to reduce exposure to potentially malicious files.
• Monitor for updates from Kingsoft regarding patches or mitigations for this vulnerability.
• Educate users on the risks associated with opening unsolicited documents.