In module wpsio.dll in WPS Office, a BSTR string stored in the file is copied to the stack buffer without strict length inspection leading to a stack buffer overflow. Proof of concept included.
38358e22e0283cc8f63c3c5da968863cd9aeb2e6d05f82b21fb4a56fc9a8dd4e