CVE-2016-4295
HighSummary
CVE-2016-4295 affects Hancom Office 2014 and can lead to a heap overflow when processing a Hangul Hcell Document (.cell). The issue arises from an index miscalculation while processing formula data used to render a chart.
Risk Assessment
This vulnerability allows an attacker to execute arbitrary code within the context of the application, posing a significant threat to data and system security.
Recommendation
It is recommended to update Hancom Office to the latest version to mitigate the risks associated with this vulnerability and to implement appropriate security measures.
Other vulnerabilities in Hancom Office 2014
See all- CVE-2025-29867High
A Type Confusion vulnerability in Hancom Office allows file content injection. Affects Hancom Office 2018, 2020, 2022, and 2024 before specific patches.
- CVE-2016-4298High
A vulnerability in Hancom Office 2014 allows for a buffer overflow when processing a Hangul HShow Document (.hpt) due to an integer overflow. This can lead to overwriting heap data, enabling code execution under the application's context.
- CVE-2016-4296High
A vulnerability in Hancom Office 2014 allows for heap corruption when processing a Hcell (.cell) document using the CSSValFormat object. The flaw occurs when the application incorrectly writes a null terminator outside the bounds of its destination, potentially leading to code execution.
- CVE-2016-4294High
CVE-2016-4294 affects Hancom Office 2014, which can lead to a heap-based buffer overflow when opening a Hangul Hcell document (.cell). The issue occurs while processing a property record within the Workbook stream, where the application uses an incorrect size to copy user-supplied data.
- CVE-2016-4292High
A vulnerability in Hancom Office 2014 allows for exploitation of a memory allocation error when processing a Hangul HShow document (.hpt). An attacker can trigger memory corruption outside the allocated buffer, potentially leading to code execution.
- CVE-2016-4291High
CVE-2016-4291 affects Hancom Office 2014, where opening a Hangul HShow document (.hpt) can lead to an integer overflow. This results in improperly allocated memory that can cause data to be written outside the allocated buffer.
- CVE-2016-4290High
A vulnerability in Hancom Office 2014 allows for memory data overwriting, potentially leading to code execution. The issue occurs when opening Hangul HShow documents (.hpt) and is related to incorrect buffer length calculations.
Original NVD description (English source)
When opening a Hangul Hcell Document (.cell) and processing a particular record within the Workbook stream, an index miscalculation leading to a heap overlow can be made to occur in Hancom Office 2014. The vulnerability occurs when processing data for a formula used to render a chart via the HncChartPlugin.hplg library. Due to a lack of bounds-checking when incrementing an index that is used for writing into a buffer for formulae, the application can be made to write pointer data outside its bounds which can lead to code execution under the context of the application.