CVE-2016-4296 - CVE House
Back to Database
Status published High CVE-2016-4296

When opening a Hangul Hcell Document (.cell) and processing a...

Vulnerability Description

When opening a Hangul Hcell Document (.cell) and processing a record that uses the CSSValFormat object, Hancom Office 2014 will search for an underscore ("_") character at the end of the string and write a null terminator after it. If the character is at the very end of the string, the application will mistakenly write the null-byte outside the bounds of its destination. This can result in heap corruption that can lead code execution under the context of the application

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-4296

Credits & Attribution

No credits recorded in the NVD database.

References

More from Hancom

View All →
CVE-2023-51598
Hancom Office Word DOC File Parsing Use-After-Free Remote Code Execution Vulnerability
High 7
CVE-2023-50235
Hancom Office Show PPT File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
High 7.8
CVE-2023-50234
Hancom Office Cell XLS File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
High 7.8
CVE-2023-40250
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')...
High 8.8
CVE-2023-32541
A use-after-free vulnerability exists in the footerr functionality of Hancom...
High 8.8

Affected Vendor

Affected Software

Hancom Office
Vulnerable Versions:
2014 VP Trial HCell.exe Product version: 9.1.0.2176, HCellApp.dll Product version: 9.1.0.2176 HCellBook.dll Product version: 9.1.0.2176

Timeline

Official Publish: January 6th, 2017
Last Modified: August 6th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.