CVE-2016-4292 - CVE House
Back to Database
Status published High CVE-2016-4292

When opening a Hangul HShow Document (.hpt) and processing a...

Vulnerability Description

When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will use a static size to allocate a heap buffer yet explicitly trust a size from the file when modifying data inside of it. Due to this, an aggressor can corrupt memory outside the bounds of this buffer which can lead to code execution under the context of the application.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-4292

Credits & Attribution

No credits recorded in the NVD database.

References

More from Hancom

View All →
CVE-2023-51598
Hancom Office Word DOC File Parsing Use-After-Free Remote Code Execution Vulnerability
High 7
CVE-2023-50235
Hancom Office Show PPT File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
High 7.8
CVE-2023-50234
Hancom Office Cell XLS File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
High 7.8
CVE-2023-40250
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')...
High 8.8
CVE-2023-32541
A use-after-free vulnerability exists in the footerr functionality of Hancom...
High 8.8

Affected Vendor

Affected Software

Hancom Office
Vulnerable Versions:
2014 VP Trial HShow.exe Product version: 9.1.0.2176 HncBM90.dll Product version: 9.1.0.2291

Timeline

Official Publish: January 6th, 2017
Last Modified: August 6th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.