CVE-2016-4292
HighSummary
A vulnerability in Hancom Office 2014 allows for exploitation of a memory allocation error when processing a Hangul HShow document (.hpt). An attacker can trigger memory corruption outside the allocated buffer, potentially leading to code execution.
Risk Assessment
The risk to the organization involves the potential for malicious code execution within the application context, which could result in data loss or system compromise.
Recommendation
It is recommended to update Hancom Office to the latest version to mitigate this vulnerability and to restrict opening unknown HShow documents.
Other vulnerabilities in Hancom Office 2014
See all- CVE-2025-29867High
A Type Confusion vulnerability in Hancom Office allows file content injection. Affects Hancom Office 2018, 2020, 2022, and 2024 before specific patches.
- CVE-2016-4298High
A vulnerability in Hancom Office 2014 allows for a buffer overflow when processing a Hangul HShow Document (.hpt) due to an integer overflow. This can lead to overwriting heap data, enabling code execution under the application's context.
- CVE-2016-4296High
A vulnerability in Hancom Office 2014 allows for heap corruption when processing a Hcell (.cell) document using the CSSValFormat object. The flaw occurs when the application incorrectly writes a null terminator outside the bounds of its destination, potentially leading to code execution.
- CVE-2016-4295High
CVE-2016-4295 affects Hancom Office 2014 and can lead to a heap overflow when processing a Hangul Hcell Document (.cell). The issue arises from an index miscalculation while processing formula data used to render a chart.
- CVE-2016-4294High
CVE-2016-4294 affects Hancom Office 2014, which can lead to a heap-based buffer overflow when opening a Hangul Hcell document (.cell). The issue occurs while processing a property record within the Workbook stream, where the application uses an incorrect size to copy user-supplied data.
- CVE-2016-4291High
CVE-2016-4291 affects Hancom Office 2014, where opening a Hangul HShow document (.hpt) can lead to an integer overflow. This results in improperly allocated memory that can cause data to be written outside the allocated buffer.
- CVE-2016-4290High
A vulnerability in Hancom Office 2014 allows for memory data overwriting, potentially leading to code execution. The issue occurs when opening Hangul HShow documents (.hpt) and is related to incorrect buffer length calculations.
Original NVD description (English source)
When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will use a static size to allocate a heap buffer yet explicitly trust a size from the file when modifying data inside of it. Due to this, an aggressor can corrupt memory outside the bounds of this buffer which can lead to code execution under the context of the application.