Critical severity · published Mar 4, 2025
CVE-2024-11957
Arbitrary Code Execution in WPS Office
9.3
CVSS
0.1%
EPSS
No
On KEV
Description
Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12.1.0.18276
on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.2.0.16909 to mitigate CVE-2024-7262 was not restrictive enough.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
WPS Office · Kingsoft
12.2.0.16909 before 12.1.0.18276 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-11957
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-11957
www.welivesecurity.com
https://www.welivesecurity.com/en/eset-research/analysis-of-two-arbitrary-code-execution-vulnerabilities-affecting-wps-office/
More from WPS Office
7.8
CVE-2024-7262
Arbitrary Code Execution in WPS Office
8.1
CVE-2023-32548
OS command injection vulnerability exists in WPS Office version 10.8.0.6186
7.8
CVE-2024-7263
Arbitrary Code Execution in WPS Office
7.8
CVE-2024-35205
The WPS Office (aka cn.wps.moffice_eng) application before 17.0.0 for Android fails to properly sanitize file names before processing them through external application…
7.8
CVE-2023-31275
An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel file