PT-2022-1947 · Kingsoft · Wps Office

Eiji James Yoshida · Published 2022-01-06 · Updated 2022-03-24 · CVE-2022-26081

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPS Office version 10.8.0.5745

Description The issue is related to the insecure loading of the shcore.dll dynamic library by the installer of WPS Office, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer. This can potentially lead to privilege escalation and the execution of malicious code.

Recommendations For WPS Office version 10.8.0.5745, consider updating to a newer version that addresses this issue, as the current version insecurely loads the shcore.dll library, posing a risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2022-01504

CVE-2022-26081

Affected Products

Wps Office

References · 7

• https://osv.dev/vulnerability/CVE-2022-26081 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26081 · Security Note
• https://support.kingsoft.jp/support-info/weakness.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01504 · Security Note
• https://t.me/cibsecurity/39165 · Telegram Post
• https://jvn.jp/en/jp/JVN21234459 · Note
• https://vuldb.com/ru/?id.195400 · Note