What is CVE-2022-25969?

CVE-2022-25969 is a high-severity vulnerability in Kingsoft Wps Office, classified under Uncontrolled Search Path Element. CVSS score: 7.8/10. Published 2022-03-17.

How severe is CVE-2022-25969?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Kingsoft Wps Office

CVE-2022-25969

The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.

Published 2022-03-17 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.008 (55.8th percentile), scored 2026-10-01.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 55.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000

Affected products

Kingsoft Wps Office — versions 10.8.0.6186
Kingsoft Japan, Inc. The Installer Of Wps Office — versions Reported for Version 10.8.0.6186

Weakness classification (CWE)

CWE-427 — Uncontrolled Search Path Element

References

support.kingsoft.jp/support-info/weakness.html (Vendor Advisory)
jvn.jp/en/jp/JVN21234459/ (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2022-25969?: CVE-2022-25969 is a high-severity vulnerability in Kingsoft Wps Office, classified under Uncontrolled Search Path Element. CVSS score: 7.8/10. Published 2022-03-17.
How severe is CVE-2022-25969?: High severity. CVSS v3 base score is 7.8 out of 10.