Heap Corruption Vulnerability in Hancom Office 2014 Hangul Hcell Document Processing

CVE-2016-4296 · MEDIUM Severity

AV:N/AC:M/AU:N/C:P/I:P/A:P

When opening a Hangul Hcell Document (.cell) and processing a record that uses the CSSValFormat object, Hancom Office 2014 will search for an underscore ("_") character at the end of the string and write a null terminator after it. If the character is at the very end of the string, the application will mistakenly write the null-byte outside the bounds of its destination. This can result in heap corruption that can lead code execution under the context of the application

Learn more about our Cis Benchmark Audit For Microsoft Office.