Path Traversal in Kingsoft WPS Office (CVE-2024-7262) Enables Arbitrary Library Load
What It Is — Kingsoft WPS Office’s promecefpluginhost.exe on Windows fails to properly validate file paths, creating a path‑traversal condition that can be abused to load an arbitrary Windows library. Successful exploitation can lead to remote code execution.
Exploitability — Publicly disclosed; no public exploit code yet, but the vulnerability is trivial to weaponize once a malicious library is placed. CVSS 7.8 (High) per NVD.
Affected Products — Kingsoft WPS Office for Windows (all versions prior to the vendor’s September 2024 patch).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous software‑inventory control and evidence of patch status, a core control objective across SOC 2, ISO 27001, and NIST CSF.
- Unpatched libraries break the “secure configuration” assurance that auditors look for; mapping this gap provides a defensible audit trail.
- Logging of plugin‑host activity supplies the evidence required for incident‑response readiness and post‑incident forensics.
Recommended Actions
- Deploy Kingsoft’s security update for CVE‑2024‑7262 without delay.
- Re‑validate your software‑asset inventory and map the patch status to the control objective for secure configuration management.
- Enable detailed logging for
promecefpluginhost.exeand monitor for unexpected library loads.
Source: CISA KEV – CVE‑2024‑7262