CVE-2024-7262: Kingsoft WPS Office path validation flaw enables arbitrary library loading

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is in CISA KEV with confirmed weaponized single-click exploitation and a CVSS 4.0 score of 9.3, making it an urgent patching priority.

What it is

Kingsoft WPS Office on Windows fails to properly validate paths in promecefpluginhost.exe, allowing an attacker to load an arbitrary Windows library. The flaw was observed weaponized as a single-click exploit delivered through a deceptive spreadsheet document, and it affects WPS Office versions from 12.2.0.13110 up to but not including 12.2.0.16412.

Impact

An attacker can execute arbitrary code in the context of the affected process, leading to full compromise of confidentiality, integrity, and availability on the victim's system. Because the exploit is single-click and weaponized, it poses a direct risk of malware installation or further lateral movement.

Attack surface

The vulnerability is reached locally through a crafted spreadsheet document that triggers promecefpluginhost.exe; the CVSS vector indicates no privileges are required but user interaction is passive (UI:P), meaning the victim must open or interact with the document. No remote network vector is described.

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2024-09-03, confirming active exploitation in the wild. EPSS gives a 30-day probability of 0.02937 (86th percentile), and the description states it was found weaponized as a single-click exploit.

What to do

• Update Kingsoft WPS Office to version 12.2.0.16412 or later as directed by the vendor advisory.
• If immediate patching is not possible, follow CISA KEV required actions: apply vendor mitigations or discontinue use of the product until mitigations are available.
• Restrict execution of promecefpluginhost.exe or block untrusted spreadsheet documents from opening in WPS Office where feasible.
• Educate users not to open unexpected or unsolicited spreadsheet attachments, as the exploit relies on a deceptive document.
• Monitor for and isolate systems that have opened suspicious spreadsheets until they can be verified clean.

Detection

• Hunt for unusual child processes or library loads originating from promecefpluginhost.exe, especially DLLs loaded from user-writable directories.
• Monitor for WPS Office opening spreadsheet files from email attachments, downloads, or temporary folders followed by unexpected process creation.
• Review endpoint logs for path traversal patterns or references to promecefpluginhost.exe in command lines or file paths.
• Correlate CISA KEV status with asset inventory to identify unpatched WPS Office installations in the environment.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.