Vulnerability Description
An exploitable use-after-free vulnerability exists in WPS Spreadsheets ( ET ) as part of WPS Office, version 11.2.0.10351. A specially-crafted XLS file can cause a use-after-free condition, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wps | Wps Office | 11.2.0.10351 |
Related Weaknesses (CWE)
References
- https://security.wps.cn/notices/28Third Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1412Third Party Advisory
- https://security.wps.cn/notices/28Third Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1412Third Party Advisory
FAQ
What is CVE-2021-40399?
CVE-2021-40399 is a vulnerability with a CVSS score of 7.8 (HIGH). An exploitable use-after-free vulnerability exists in WPS Spreadsheets ( ET ) as part of WPS Office, version 11.2.0.10351. A specially-crafted XLS file can cause a use-after-free condition, resulting ...
How severe is CVE-2021-40399?
CVE-2021-40399 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-40399?
Check the references section above for vendor advisories and patch information. Affected products include: Wps Wps Office.