CVE-2024-7262

What it actually does

CVE-2024-7262 is an improper path validation flaw in Kingsoft WPS Office for Windows, specifically involving promecefpluginhost.exe in versions 12.2.0.13110 through 12.2.0.13489 inclusive. A crafted document can cause WPS Office to resolve an attacker-controlled path and load an arbitrary Windows DLL, resulting in code execution in the context of the user who opened or interacted with the document. Because the issue was weaponized as a single-click document exploit and is listed in CISA KEV, it should be treated as actively exploitable despite the moderate EPSS score. Note: the provided affected-package list and fixed versions reference AlmaLinux dbus packages, which do not align with the WPS Office Windows vulnerability description; validate advisory/package mapping before using those package entries for remediation decisions.

Why it matters to the business

Successful exploitation can let an attacker run malware on an employee workstation after the user opens or clicks within a deceptive spreadsheet. This can lead to credential theft, data exfiltration, persistence, lateral movement, and deployment of additional tooling inside the organization. The vulnerability is in CISA KEV with a remediation due date of 2024-09-24 and has been observed in the wild, so unpatched WPS Office installations should be prioritized even if broad automated exploitation is less likely than for internet-facing server flaws.

How an attack unfolds

An attacker prepares a malicious spreadsheet or office document designed to trigger the vulnerable WPS Office component. The document abuses improper path validation in promecefpluginhost.exe so that, when the victim opens the file or performs the required single-click interaction, WPS Office loads a DLL from a path controlled or influenced by the attacker rather than a trusted application location. The malicious DLL executes with the privileges of the current Windows user. From there, the attacker can establish persistence, collect credentials and documents, connect to command-and-control infrastructure, and use the compromised workstation as a foothold for further intrusion. Public reporting indicates this class of exploit has been weaponized in deceptive spreadsheet lures; the supplied threat-actor field appears to describe the vulnerability rather than a named actor, so attribution should be based on independent telemetry.

How to fix it

Upgrade Kingsoft WPS Office for Windows to a vendor-fixed version newer than the affected range, specifically beyond 12.2.0.13489, or apply the vendor security update that addresses CVE-2024-7262. Remove or block vulnerable WPS Office versions 12.2.0.13110 through 12.2.0.13489 where immediate upgrade is not possible. Use application control to prevent promecefpluginhost.exe and other Office child processes from loading DLLs from user-writable locations such as Downloads, Desktop, Temp, AppData, removable media, and network shares. Harden email and web gateways to detonate or quarantine unsolicited spreadsheets and documents. Disable or restrict risky protocol handlers and external content handling where operationally feasible. The provided fixed versions for AlmaLinux dbus packages — 1:1.12.8-23.el8_7.1 for dbus, dbus-common, dbus-daemon, dbus-devel, dbus-libs, dbus-tools, and dbus-x11 — do not appear to correspond to this WPS Office Windows vulnerability; apply them only if confirmed relevant by the operating-system vendor advisory.

How to confirm the fix worked

Inventory Windows endpoints for WPS Office versions and confirm no installations are within 12.2.0.13110 through 12.2.0.13489 inclusive. Confirm upgraded systems report a WPS Office version newer than the affected range or a vendor build explicitly documenting the fix. Use EDR or Sysmon testing to verify that promecefpluginhost.exe cannot load DLLs from user-writable or remote paths. Review application allowlisting policy enforcement for WPS Office child processes. If vulnerability scanners flag unrelated AlmaLinux dbus packages for this CVE, validate the scanner plugin mapping against vendor advisories because the supplied package data is inconsistent with the described Windows WPS Office issue.

Typical attack path

1. Attacker crafts a deceptive spreadsheet or office document that triggers the vulnerable WPS Office code path.
2. Attacker delivers the document through phishing, messaging, file sharing, watering-hole content, or another social-engineering channel.
3. Victim opens the document or performs the required click/interaction in a vulnerable WPS Office version.
4. promecefpluginhost.exe performs unsafe path handling and loads an attacker-controlled Windows DLL.
5. The malicious DLL executes under the victim user context.
6. Attacker deploys follow-on payloads, establishes persistence, steals credentials or files, and attempts lateral movement.

How to detect it

Check EDR, Sysmon, Windows Security logs, application-control logs, email gateway logs, web proxy logs, and file telemetry for evidence that a user opened a suspicious spreadsheet shortly before promecefpluginhost.exe loaded an unexpected DLL or spawned unusual child processes. Prioritize events where promecefpluginhost.exe loads DLLs from user-writable locations such as Downloads, Desktop, Temp, AppData, removable drives, or network shares. Look for document-open events followed by new outbound network connections, archive extraction, script interpreter execution, credential-access tools, scheduled task creation, Run-key changes, or unknown binaries written under the user profile. In mail and web logs, search for deceptive spreadsheet delivery to users running affected WPS Office versions. In EDR telemetry, correlate process lineage from WPS Office components to rundll32.exe, regsvr32.exe, powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe, certutil.exe, bitsadmin.exe, or unknown executables. Because the exploit was reportedly weaponized, absence of the CVE string in logs is not meaningful; focus on behavioral traces of malicious DLL loading and follow-on execution.

• promecefpluginhost.exe
• CVE-2024-7262
• WPS Office 12.2.0.13110
• WPS Office 12.2.0.13489
• ImageLoaded=*\\AppData\\*.dll
• ImageLoaded=*\\Downloads\\*.dll
• ImageLoaded=*\\Desktop\\*.dll
• ImageLoaded=*\\Temp\\*.dll
• Image=promecefpluginhost.exe ImageLoaded=*.dll
• ParentImage=*\\promecefpluginhost.exe Image=*\\rundll32.exe
• ParentImage=*\\promecefpluginhost.exe Image=*\\regsvr32.exe
• ParentImage=*\\promecefpluginhost.exe Image=*\\powershell.exe
• ParentImage=*\\promecefpluginhost.exe Image=*\\cmd.exe
• ParentImage=*\\promecefpluginhost.exe Image=*\\wscript.exe
• ParentImage=*\\promecefpluginhost.exe Image=*\\cscript.exe
• ParentImage=*\\promecefpluginhost.exe Image=*\\mshta.exe

What your security team should do

• Immediately identify and patch or remove vulnerable WPS Office for Windows installations, prioritizing systems used to open external documents.
• Treat this as urgent because it is listed in CISA KEV, has an official KEV due date of 2024-09-24, and has documented in-the-wild exploitation.
• Hunt for suspicious executions of promecefpluginhost.exe, especially DLL loads from user profile, temporary, download, removable, or network-share paths.
• Deploy or tune EDR rules for Office-process DLL sideloading and suspicious child processes launched after document opening.
• Block or quarantine unsolicited spreadsheet attachments and documents that contain external links, embedded objects, unusual protocol handlers, or paths referencing DLL content.
• Validate vulnerability-management data for this CVE because the provided AlmaLinux dbus package mappings appear inconsistent with the WPS Office Windows vulnerability.
• If evidence of exploitation is found, perform full endpoint triage including memory/process review, persistence checks, credential-theft investigation, and lateral-movement scoping.