CVE-2016-4290
HighSummary
A vulnerability in Hancom Office 2014 allows for memory data overwriting, potentially leading to code execution. The issue occurs when opening Hangul HShow documents (.hpt) and is related to incorrect buffer length calculations.
Risk Assessment
Exploitation of this vulnerability could allow an attacker to execute malicious code in the context of the application, posing a serious security threat to the system.
Recommendation
It is recommended to update Hancom Office to the latest version to mitigate this vulnerability and to monitor systems for unauthorized activities.
Other vulnerabilities in Hancom Office 2014
See all- CVE-2025-29867High
A Type Confusion vulnerability in Hancom Office allows file content injection. Affects Hancom Office 2018, 2020, 2022, and 2024 before specific patches.
- CVE-2016-4298High
A vulnerability in Hancom Office 2014 allows for a buffer overflow when processing a Hangul HShow Document (.hpt) due to an integer overflow. This can lead to overwriting heap data, enabling code execution under the application's context.
- CVE-2016-4296High
A vulnerability in Hancom Office 2014 allows for heap corruption when processing a Hcell (.cell) document using the CSSValFormat object. The flaw occurs when the application incorrectly writes a null terminator outside the bounds of its destination, potentially leading to code execution.
- CVE-2016-4295High
CVE-2016-4295 affects Hancom Office 2014 and can lead to a heap overflow when processing a Hangul Hcell Document (.cell). The issue arises from an index miscalculation while processing formula data used to render a chart.
- CVE-2016-4294High
CVE-2016-4294 affects Hancom Office 2014, which can lead to a heap-based buffer overflow when opening a Hangul Hcell document (.cell). The issue occurs while processing a property record within the Workbook stream, where the application uses an incorrect size to copy user-supplied data.
- CVE-2016-4292High
A vulnerability in Hancom Office 2014 allows for exploitation of a memory allocation error when processing a Hangul HShow document (.hpt). An attacker can trigger memory corruption outside the allocated buffer, potentially leading to code execution.
- CVE-2016-4291High
CVE-2016-4291 affects Hancom Office 2014, where opening a Hangul HShow document (.hpt) can lead to an integer overflow. This results in improperly allocated memory that can cause data to be written outside the allocated buffer.
Original NVD description (English source)
When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will attempt to allocate space for a block of data within the file. When calculating this length, the application will use a value from the file and add a constant to it without checking whether the addition of the constant will cause the integer to overflow which will cause the buffer to be undersized when the application tries to copy file data into it. This allows one to overwrite contiguous data in the heap which can lead to code-execution under the context of the application.