Arbitrary Code Execution Vulnerability in WPS Office by Kingsoft
CVE-2022-26081

7.8HIGH

Key Information:

Vendor

Kingsoft Japan, Inc.

Status
The Installer Of WPs Office
Vendor
CVE Published:
17 March 2022

What is CVE-2022-26081?

The installation process of WPS Office Version 10.8.0.5745 has a vulnerability where the installer insecurely loads the shcore.dll file. This flaw may allow an attacker to execute arbitrary code with the same privileges as the user running the installer, potentially leading to unauthorized access and further exploitation of the system.

Affected Version(s)

The installer of WPS Office Reported for Version 10.8.0.5745

References

https://support.kingsoft.jp/support-info/weakness.html
x_refsource_CONFIRM
https://jvn.jp/en/jp/JVN21234459/
third-party-advisoryx_refsource_JVN

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2022-26081 : Arbitrary Code Execution Vulnerability in WPS Office by Kingsoft