Kingsoft vulnerabilities
We track 9 vulnerabilities in Kingsoft products across 2 products. 9 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on March 27, 2025.
Latest Kingsoft vulnerabilities
- 9.5 Critical severity
WPS Office: Inadequate Encryption Strength
The use of a weak cryptographic key pair in the signature verification process in WPS Office (Kingsoft) on Windows allows an attacker who successfully recovered the private key to sign components. As older versions of WPS Office did not validate the update ser
- 9.3 Critical severity
WPS Office: Improper Verification of Cryptographic Signature
Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12.1.0.18276 on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.2.0.16909 to mitigate CVE-20
- 7.8 High severity
WPS Office: Improper Limitation of a Pathname to a Restricted Directory
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.1.0.17119 to mitigate C
- 7.8 High severity
Kingsoft WPS Office Path Traversal Exploited
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click
- 7.8 High severity
wps_office: Improper Limitation of a Pathname to a Restricted Directory
The WPS Office (aka cn.wps.moffice_eng) application before 17.0.0 for Android fails to properly sanitize file names before processing them through external application interactions, leading to a form of path traversal. This potentially enables any application
- 7.8 High severity
The installer of WPS Office: Uncontrolled Search Path Element
The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.
- 7.8 High severity
The installer of WPS Office: Uncontrolled Search Path Element
The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.
- 7.8 High severity
KINGSOFT Internet Security 9 Plus: Out-of-bounds Write
The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading to stack-based buffer overflow.
- 7.8 High severity
WPS Office for Windows: Incorrect Default Permissions
The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the service program is installed.