Weak Cryptographic Key Vulnerability in WPS Office by Kingsoft

CVE-2025-2516

What is CVE-2025-2516?

A vulnerability exists in WPS Office due to the use of a weak cryptographic key pair during the signature verification process. This allows attackers who obtain the private key to sign components maliciously. Additionally, older versions of WPS Office do not adequately validate the update server's certificate, leaving them susceptible to Adversary-In-The-Middle attacks, where unauthorized updates can be injected, potentially compromising users’ systems and data security.

References