Arbitrary Code Execution Vulnerability in WPS Office by Kingsoft
CVE-2022-25969

7.8HIGH

Key Information:

Vendor

Kingsoft Japan, Inc.

Status
The Installer Of WPs Office
Vendor
CVE Published:
17 March 2022

What is CVE-2022-25969?

The installer for WPS Office Version 10.8.0.6186 is prone to an arbitrary code execution vulnerability due to insecure loading of the VERSION.DLL file and potentially other DLLs. This flaw enables an attacker to run malicious code with the same privileges as the user executing the installer, posing significant risks to user systems. Users are advised to update their software to mitigate these security threats effectively.

Affected Version(s)

The installer of WPS Office Reported for Version 10.8.0.6186

References

https://support.kingsoft.jp/support-info/weakness.html
x_refsource_CONFIRM
https://jvn.jp/en/jp/JVN21234459/
third-party-advisoryx_refsource_JVN

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2022-25969 : Arbitrary Code Execution Vulnerability in WPS Office by Kingsoft