CVE-2022-26081

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
KINGSOFT JAPAN, INC.	The installer of WPS Office	Reported for Version 10.8.0.5745

References

https://jvn.jp/en/jp/JVN21234459/Third Party Advisory
https://support.kingsoft.jp/support-info/weakness.htmlVendor Advisory
https://jvn.jp/en/jp/JVN21234459/Third Party Advisory
https://support.kingsoft.jp/support-info/weakness.htmlVendor Advisory

Timeline

Published: Mar 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-260829.8A file write vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. CVE-2022-260837.5Generation of weak initialization vector in an Intel(R) IPP Cryptography software library before version 2021.5 may allow an unauthenticated CVE-2022-260858.8An OS command injection vulnerability exists in the httpd wlscan_ASP functionality of InHand Networks InRouter302 V3.5.4. A specially-crafte CVE-2022-260867.3Uncontrolled search path element in the PresentMon software maintained by Intel(R) before version 1.7.1 may allow an authenticated user to p CVE-2022-260885.4An issue was discovered in BMC Remedy before 22.1. Email-based Incident Forwarding allows remote authenticated users to inject HTML (such as CVE-2022-26098.8Use after free in Nearby Share in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage CVE-2022-260903.3Improper access control vulnerability in SamsungContacts prior to SMR Apr-2022 Release 1 allows that attackers can access contact informatio CVE-2022-260916.8Improper access control vulnerability in Knox Manage prior to SMR Apr-2022 Release 1 allows that physical attackers can bypass Knox Manage u CVE-2022-260927.8Improper boundary check in Quram Agif library prior to SMR Apr-2022 Release 1 allows arbitrary code execution.CVE-2022-260939.8Null pointer dereference vulnerability in parser_irot function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds writ CVE-2022-260949.8Null pointer dereference vulnerability in parser_auxC function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds writ CVE-2022-260959.8Null pointer dereference vulnerability in parser_colr function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds writ