CVE-2022-26081
📋 TL;DR
This vulnerability in WPS Office installer allows attackers to execute arbitrary code by exploiting insecure DLL loading. It affects users running WPS Office Version 10.8.0.5745 installer on Windows systems. The attacker needs to place a malicious shcore.dll in a location the installer searches before legitimate system directories.
💻 Affected Systems
- WPS Office
📦 What is this software?
Wps Office by Kingsoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the user running the installer, potentially leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation where an attacker with initial access can execute code with higher privileges, install malware, or pivot to other systems.
If Mitigated
Limited impact with proper application whitelisting, restricted user privileges, and security controls preventing unauthorized DLL execution.
🎯 Exploit Status
Requires local access to plant malicious DLL and timing to execute when installer runs. Attack vector is local, not remote.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 10.8.0.5745
Vendor Advisory: https://support.kingsoft.jp/support-info/weakness.html
Restart Required: No
Instructions:
1. Update WPS Office to latest version. 2. If using version 10.8.0.5745, download and install newer version from official WPS Office website. 3. Verify installation completes successfully.
🔧 Temporary Workarounds
Restrict installer execution
windowsLimit who can run WPS Office installer and from which directories
Enable DLL Safe Search Mode
windowsConfigure Windows to prevent insecure DLL loading from current directory
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode /t REG_DWORD /d 1 /f
🧯 If You Can't Patch
- Run installer only from trusted, controlled directories where attackers cannot place files
- Use application control/whitelisting to prevent unauthorized DLL execution
🔍 How to Verify
Check if Vulnerable:
Check WPS Office version: Open WPS Office → Help → About WPS Office. If version is 10.8.0.5745, you are vulnerable.Check Version:
wmic product where name="WPS Office" get versionVerify Fix Applied:
After updating, verify version is newer than 10.8.0.5745 in Help → About WPS Office.📡 Detection & Monitoring
Log Indicators:
- Process creation events for WPS Office installer loading DLLs from unusual locations
- File creation events for shcore.dll in directories accessible to users
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
Process creation where process_name contains "wps" AND process_command_line contains "install" AND loaded_module contains "shcore.dll"