Hancom vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-29867 Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Hancom Inc.High 8.5 · Feb 4, 2026
• CVE-2023-51598 Hancom Office Word DOC File Parsing Use-After-Free Remote Code Execution Vulnerability.High 8.8 · May 2, 2024
• CVE-2023-50235 Hancom Office Show PPT File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.High 7.8 · May 2, 2024
• CVE-2023-50234 Hancom Office Cell XLS File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.High 7.8 · May 2, 2024
• CVE-2023-40250 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Hancom HCell on Windows allows Overflow Buffers.This issue affects HCellHigh 8.8 · Jan 11, 2024
• CVE-2023-32541 A use-after-free vulnerability exists in the footerr functionality of Hancom Office 2020 HWord 11.0.0.7520.High 8.8 · Sep 27, 2023
• CVE-2022-33896 A buffer underflow vulnerability exists in the way Hword of Hancom Office 2020 version 11.0.0.5357 parses XML-based office files.High 7.8 · Oct 7, 2022
• CVE-2021-21958 A heap-based buffer overflow vulnerability exists in the Hword HwordApp.dll functionality of Hancom Office 2020 11.0.0.2353.High 7.8 · Feb 16, 2022
• CVE-2019-16338 The tfo_common component in HwordApp.dll in Hancom Office 9.6.1.7634 allows a use-after-free via a crafted .docx file.High 7.8 · Mar 19, 2020
• CVE-2019-16337 The hncbd90 component in Hancom Office 9.6.1.9403 allows a use-after-free via an unknown object in a crafted .docx file.High 7.8 · Mar 19, 2020
• CVE-2018-5195 Hancom NEO versions 9.6.1.5183 and earlier have a buffer Overflow vulnerability that leads remote attackers to execute arbitrary commands when performing the hyCritical 9.8 · Jan 17, 2018
• CVE-2015-6585 hwpapp.dll in Hangul Word Processor allows remote attackers to execute arbitrary code via a crafted heap spray, and by leveraging a "type confusion" via an HWPXHigh 7.8 · Jul 25, 2017
• CVE-2017-2819 An exploitable heap-based buffer overflow exists in the Hangul Word Processor component (version 9.6.1.4350) of Hancom Thinkfree Office NEO 9.6.1.4902.High 8.8 · May 24, 2017
• CVE-2016-4293 Multiple heap-based buffer overflows in the (1) CBookBase::SetDefTableStyle and (2) CBookBase::SetDefPivotStyle functions in Hancom Office 2014 VP allow remote High 7.8 · Apr 20, 2017
• CVE-2016-4298 When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will attempt to allocate space for a list of elemHigh 7.8 · Jan 6, 2017
• CVE-2016-4296 When opening a Hangul Hcell Document (.cell) and processing a record that uses the CSSValFormat object, Hancom Office 2014 will search for an underscore ("_") cHigh 7.8 · Jan 6, 2017
• CVE-2016-4295 When opening a Hangul Hcell Document (.cell) and processing a particular record within the Workbook stream, an index miscalculation leading to a heap overlow caHigh 7.8 · Jan 6, 2017
• CVE-2016-4294 When opening a Hangul Hcell Document (.cell) and processing a property record within the Workbook stream, Hancom Office 2014 will attempt to allocate space for High 7.8 · Jan 6, 2017
• CVE-2016-4292 When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will use a static size to allocate a heap buffer High 7.8 · Jan 6, 2017
• CVE-2016-4291 When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will use a field from the structure in an operatiHigh 7.8 · Jan 6, 2017
• CVE-2016-4290 When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will attempt to allocate space for a block of datHigh 7.8 · Jan 6, 2017
• CVE-2015-2810 Integer overflow in the HwpApp::CHncSDS_Manager function in Hancom Office HanWord processor, as used in Hwp 2014 VP before 9.1.0.2342, HanWord Viewer 2007 and VHigh 7.5 · May 15, 2015
• CVE-2013-7420 Buffer overflow in Hancom Office 2010 SE allows remote attackers to execute arbitrary via a long string in the Text attribute in a TEXTART XML element in an HMLHigh 7.5 · Jan 12, 2015
• CVE-2012-1206 Multiple integer overflows in Hancom Office 2010 SE 8.5.5 allow remote attackers to execute arbitrary code via large dimension values in a (1) JPG image to the High 9.3 · Feb 24, 2012