CVE-2024-7262: Kingsoft WPS Office Path Traversal Flaw

CVE-2024-7262 Overview

CVE-2024-7262 is a critical path traversal vulnerability in Kingsoft WPS Office affecting versions ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows. The vulnerability exists in promecefpluginhost.exe and allows an attacker to load an arbitrary Windows library through improper path validation. This vulnerability has been weaponized as a single-click exploit delivered through deceptive spreadsheet documents, making it particularly dangerous for enterprise environments.

Critical Impact

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Attackers can achieve arbitrary code execution through a single-click exploit embedded in malicious spreadsheet documents.

Affected Products

• Kingsoft WPS Office versions 12.2.0.13110 to 12.2.0.16412 (exclusive)
• Microsoft Windows (all supported versions as the underlying platform)
• Systems running WPS Office with default configurations

Discovery Timeline

• 2024-08-15 - CVE-2024-7262 published to NVD
• 2025-10-30 - Last updated in NVD database

Technical Details for CVE-2024-7262

Vulnerability Analysis

This vulnerability stems from improper path validation in the promecefpluginhost.exe component of Kingsoft WPS Office. The application fails to properly sanitize file path inputs, allowing attackers to traverse directory structures and load arbitrary Windows dynamic-link libraries (DLLs). When a user opens a specially crafted spreadsheet document, the malicious payload executes without additional user interaction beyond the initial file open action.

The single-click nature of this exploit makes it particularly effective for targeted attacks, as victims only need to open what appears to be a legitimate spreadsheet document. The embedded malicious content leverages the path traversal flaw to execute arbitrary code with the privileges of the current user.

Root Cause

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The promecefpluginhost.exe component does not adequately validate or sanitize user-supplied path inputs before using them to load Windows libraries. This allows attackers to use path traversal sequences (such as ../) or absolute paths to reference and load malicious DLLs from attacker-controlled locations.

Attack Vector

The attack vector is local, requiring user interaction to open a malicious document. However, the practical attack scenario involves:

1. An attacker crafts a deceptive spreadsheet document containing malicious embedded content
2. The document is delivered to the victim via email, file sharing, or other social engineering methods
3. When the victim opens the document in WPS Office, the path traversal vulnerability is triggered
4. The malicious payload loads an arbitrary Windows library, achieving code execution
5. The attacker gains control with the privileges of the user running WPS Office

The vulnerability mechanism exploits the trust relationship between WPS Office and its plugin host component. When promecefpluginhost.exe processes document content, it fails to restrict library loading paths to expected directories, enabling the loading of attacker-supplied DLLs.

Detection Methods for CVE-2024-7262

Indicators of Compromise

• Unexpected child processes spawned by promecefpluginhost.exe or WPS Office executables
• DLL loading events from unusual directories outside the WPS Office installation path
• Suspicious spreadsheet documents with embedded objects or unusual metadata
• Network connections initiated by WPS Office components to unknown external hosts

Detection Strategies

• Monitor process creation events for promecefpluginhost.exe and track any child processes or library loads
• Implement file integrity monitoring on WPS Office installation directories to detect unauthorized DLL additions
• Use endpoint detection and response (EDR) solutions to identify path traversal patterns in file access logs
• Deploy YARA rules targeting known malicious document structures associated with this exploit

Monitoring Recommendations

• Enable detailed logging for WPS Office application events and Windows DLL loading activities
• Configure SIEM alerts for anomalous library loading patterns from WPS Office processes
• Establish baseline behavior for WPS Office components and alert on deviations
• Monitor for suspicious document downloads or email attachments targeting users with WPS Office installed

How to Mitigate CVE-2024-7262

Immediate Actions Required

• Update Kingsoft WPS Office to version 12.2.0.16412 or later immediately
• Block execution of untrusted spreadsheet documents until patches are applied
• Implement application whitelisting to prevent unauthorized DLL loading
• Educate users about the risks of opening spreadsheet documents from unknown sources

Patch Information

Kingsoft has released a security update addressing this vulnerability. Organizations should update WPS Office to version 12.2.0.16412 or later. The vendor advisory with update information is available at the WPS Product Update page. Given this vulnerability's inclusion in the CISA Known Exploited Vulnerabilities catalog, federal agencies and critical infrastructure organizations should prioritize remediation according to CISA's required timelines.

Workarounds

• Restrict users from opening spreadsheet documents from untrusted sources until patching is complete
• Implement network segmentation to limit the impact of potential exploitation
• Use Microsoft AppLocker or similar tools to restrict DLL loading to approved directories only
• Consider temporarily disabling or removing WPS Office in high-risk environments until patches can be deployed

Mitigation should focus on updating WPS Office to the patched version and implementing defense-in-depth controls. Organizations using SentinelOne can leverage behavioral AI detection to identify exploitation attempts, as the platform monitors for anomalous process behavior and suspicious library loading patterns characteristic of this attack technique.