Vulnerability Intelligence Report
Use of a weak cryptographic key in the signature verification process in WPS Office
CVE-2025-2516
The use of a weak cryptographic key pair in the signature verification process in WPS Office (Kingsoft) on Windows allows an attacker who successfully recovered the private key to sign components. As older versions of WPS Office did not validate the update server's certificate, an Adversary-In-The-Middle attack was possible allowing updates to be hijacked.
No Active Exploit Signals
CVSS Base Score
9.5
CRITICAL
EPSS Probability:0.12%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-326 ↗CWE-326 Inadequate Encryption Strength
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Kingsoft | WPS Office | 12.1.0.18276 (unknown) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.121%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | ESET, spol. s r.o. · Vendor · Slovak Republic |
| Reserved | 2025-03-19T07:49:48 |
| Published | 2025-03-27T14:29:22 |
| Last Updated | 2025-03-27T15:15:56 |
Community Chatter & Buzz