Loading vulnerability…
CVE-2024-7263 is a high-severity improper path validation vulnerability in Kingsoft WPS Office for Windows affecting versions from 12.2.0.13110 up to but excluding 12.2.0.17115. The flaw resides in promecefpluginhost.exe, which does not sufficiently sanitize a parameter used in library loading. As a result, an attacker can cause the application to load an arbitrary Windows library from an attacker-controlled path. The issue was identified after review of the vendor’s initial fix for CVE-2024-7262, which did not fully address the underlying input-validation problem and left an alternate exploitation path reachable through another unsanitized parameter. In practical exploitation, the weakness can be chained with document-based social engineering and WPS Spreadsheet behavior to trigger loading and execution of attacker-supplied code.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A second vulnerability referenced as part of a related exploit chain associated with the same productivity-suite targeting; the content does not provide technical details beyond its linkage to the chain.
A second high-severity arbitrary code execution vulnerability in WPS Office for Windows discovered during analysis of the patch/root cause for CVE-2024-7262; it resulted from improper input validation and represented another way to exploit the faulty code.
A second high-severity vulnerability in WPS Office for Windows discovered after patch analysis, caused by improper input validation and representing another way to exploit the same faulty code path.
A WPS Office vulnerability that can be exploited via DLL hijacking (abusing the ksoqing custom protocol handler) leading to loading of a remote/malicious library by a WPS Office component.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.