CVE-2025-29867: Hancom Office Type Confusion Vulnerability

CVE-2025-29867 Overview

CVE-2025-29867 is a Type Confusion vulnerability (CWE-843) affecting multiple versions of Hancom Office suite products. This vulnerability allows attackers to exploit improper type handling within Hancom Office applications, potentially leading to file content injection attacks. By crafting malicious documents that trigger type confusion during parsing, attackers can manipulate how the application processes data, leading to serious security implications including potential code execution.

Critical Impact

This type confusion vulnerability in Hancom Office products can be exploited through malicious document files, potentially allowing attackers to inject arbitrary content or execute code in the context of the affected application.

Affected Products

• Hancom Office 2018: versions before 10.0.0.12681
• Hancom Office 2020: versions before 11.0.0.8916
• Hancom Office 2022: versions before 12.0.0.4426
• Hancom Office 2024: versions before 13.0.0.3050

Discovery Timeline

• 2026-02-04 - CVE-2025-29867 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-29867

Vulnerability Analysis

The type confusion vulnerability in Hancom Office products occurs when the application incorrectly handles object types during document processing. When a user opens a specially crafted document, the application may misinterpret an object of one type as another type, leading to improper memory access or data manipulation.

This vulnerability requires local access and user interaction, meaning an attacker must convince a victim to open a malicious document file. Once triggered, the vulnerability can enable file content injection, potentially allowing the attacker to modify document data, corrupt memory structures, or achieve further exploitation depending on the context.

Type confusion vulnerabilities are particularly dangerous in document processing applications because they handle complex file formats with multiple object types. When type validation fails, it can lead to reading or writing data using incorrect type assumptions, which may expose sensitive memory regions or allow control flow hijacking.

Root Cause

The root cause of this vulnerability lies in inadequate type validation within Hancom Office's document parsing routines. When processing certain document elements, the application fails to properly verify that objects conform to their expected types before accessing them. This allows a crafted document to present an object of one type while the application treats it as a different type, resulting in type confusion.

The vulnerability classification under CWE-843 (Access of Resource Using Incompatible Type) indicates that the application accesses a resource using a type that is incompatible with the resource's actual type, leading to undefined behavior that can be exploited by attackers.

Attack Vector

The attack vector for CVE-2025-29867 is local, requiring an attacker to deliver a malicious document file to the target system. The exploitation scenario typically involves:

1. An attacker crafts a malicious Hancom Office document containing specially structured objects designed to trigger the type confusion
2. The malicious document is delivered to the victim through email attachments, file sharing, or downloads
3. When the victim opens the document with a vulnerable version of Hancom Office, the type confusion is triggered
4. The vulnerability allows file content injection, potentially enabling further malicious actions

The vulnerability affects all major recent versions of Hancom Office (2018, 2020, 2022, and 2024), making it a widespread concern for organizations using this popular Korean office suite.

Detection Methods for CVE-2025-29867

Indicators of Compromise

• Presence of unusually structured Hancom Office documents (.hwp, .hwpx, .docx formats) with anomalous object type declarations
• Unexpected crashes or abnormal behavior when opening Hancom Office documents
• Memory access violations or exceptions in Hancom Office processes
• Suspicious document files received from unknown or untrusted sources

Detection Strategies

• Implement file integrity monitoring for Hancom Office document files before opening
• Deploy endpoint detection and response (EDR) solutions capable of detecting type confusion exploitation attempts
• Monitor for abnormal Hancom Office process behavior including unexpected memory access patterns
• Use sandboxing solutions to analyze suspicious documents before allowing users to open them

Monitoring Recommendations

• Enable detailed logging for Hancom Office applications to capture processing errors and exceptions
• Configure security information and event management (SIEM) systems to alert on Hancom Office crashes or abnormal terminations
• Monitor file download activity for Hancom Office document formats from untrusted sources
• Track user-reported issues related to document corruption or application instability

How to Mitigate CVE-2025-29867

Immediate Actions Required

• Update all Hancom Office installations to the latest patched versions immediately
• Block or quarantine Hancom Office documents from untrusted sources until systems are patched
• Educate users about the risks of opening documents from unknown senders
• Consider implementing application allowlisting to prevent execution of vulnerable versions

Patch Information

Hancom Inc. has released security patches addressing this vulnerability. Organizations should update to the following minimum versions:

Patches can be obtained from the Hancom Download Center. Additional security advisory details are available from Boho Security Advisory.

Workarounds

• Implement strict email filtering to block or quarantine Hancom Office document attachments until patches are applied
• Use Protected View or sandboxed environments when opening documents from external sources
• Disable automatic document opening and require manual user confirmation for Hancom Office files
• Deploy network-level document scanning to detect potentially malicious files before they reach endpoints