Hancom Office Type Confusion Vulnerability Allowing File Content Injection

A type confusion vulnerability has been identified in Hancom Office 2018, 2020, 2022, and 2024 versions prior to specific release numbers. This vulnerability allows for file content injection, arising from inadequate input validation during the processing of DOC documents.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution.

Remediation

Users can update to Hancom Office 2018 version 10.0.0.12681 or later, Hancom Office 2020 version 11.0.0.8916 or later, Hancom Office 2022 version 12.0.0.4426 or later, and Hancom Office 2024 version 13.0.0.3050 or later. Instructions for downloading the latest version or patch are available on the Hancom website.