CVE-2022-33896 — HIGH (7.8)

Vulnerability Description

A buffer underflow vulnerability exists in the way Hword of Hancom Office 2020 version 11.0.0.5357 parses XML-based office files. A specially-crafted malformed file can cause memory corruption by using memory before buffer start, which can lead to code execution. A victim would need to access a malicious file to trigger this vulnerability.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Hancom	Hancom Office 2020	11.0.0.5357

Related Weaknesses (CWE)

CWE-124

References

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1574ExploitThird Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1574ExploitThird Party Advisory

FAQ

What is CVE-2022-33896?

CVE-2022-33896 is a vulnerability with a CVSS score of 7.8 (HIGH). A buffer underflow vulnerability exists in the way Hword of Hancom Office 2020 version 11.0.0.5357 parses XML-based office files. A specially-crafted malformed file can cause memory corruption by usin...

How severe is CVE-2022-33896?

CVE-2022-33896 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-33896?

Check the references section above for vendor advisories and patch information. Affected products include: Hancom Hancom Office 2020.