CVE-2020-25291: Kingsoft WPS Office

High severity, CVSS 7.8. EPSS: 1.6% chance of exploitation in the next 30 days.

GdiDrawHoriLineIAlt in Kingsoft WPS Office before 11.2.0.9403 allows remote heap corruption via a crafted PLTE chunk in PNG data within a Word document. This is related to QBrush::setMatrix in gui/painting/qbrush.cpp in Qt 4.x.

Affected products

• Kingsoft WPS Office: before 11.2.0.9403 (fixed in 11.2.0.9403)

Published 2020-09-13. Last modified 2026-06-17.