An exploitable use-after-free vulnerability exists in WPS Spreadsheets ( ET ) as part of WPS Office, version 11.2.0.10351. A specially-crafted XLS file can cause a use-after-free condition, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.
References
| Link | Resource |
|---|---|
| https://security.wps.cn/notices/28 | Third Party Advisory |
| https://talosintelligence.com/vulnerability_reports/TALOS-2021-1412 | Third Party Advisory |
Configurations
History
23 May 2022, 18:59
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:wps:wps_office:11.2.0.10351:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 7.8 |
| CWE | CWE-416 | |
| References | (CONFIRM) https://security.wps.cn/notices/28 - Third Party Advisory | |
| References | (MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2021-1412 - Third Party Advisory |
12 May 2022, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | An exploitable use-after-free vulnerability exists in WPS Spreadsheets ( ET ) as part of WPS Office, version 11.2.0.10351. A specially-crafted XLS file can cause a use-after-free condition, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability. |
12 May 2022, 17:24
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-05-12 17:15
Updated : 2024-02-04 22:29
NVD link : CVE-2021-40399
Mitre link : CVE-2021-40399
CVE.ORG link : CVE-2021-40399
JSON object : View
Products Affected
wps
- wps_office
CWE
CWE-416
Use After Free