High 8.5Published Feb 3, 2026

CVE-2025-29867Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Hancom Inc.

Updated under an hour ago (Oct 28, 2026, 3:40 AM ET)

Does this affect you?

It affects Hancom Inc. Hancom Office 2018 and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Hancom Inc. Hancom Office 2018

Exploited in the last 30 days

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Hancom Inc. Hancom Office 2018, Hancom Inc. Hancom Office 2020, Hancom Inc. Hancom Office 2022, Hancom Inc. Hancom Office 2024 allows File Content Injection.This issue affects Hancom Office 2018: before 10.0.0.12681; Hancom Office 2020: before 11.0.0.8916; Hancom Office 2022: before 12.0.0.4426; Hancom Office 2024: before 13.0.0.3050.

CVSS: 8.5 HIGH (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-843
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: krcert
NVD analysis: Deferred
Record last updated: Feb 26, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Hancom Inc. Hancom Office 2018 hancom:office_2018 (from the name)	before 10.0.0.12681; fixed at 10.0.0.12681	CNA record
Hancom Inc. Hancom Office 2020 hancom:office_2020 (from the name)	before 11.0.0.8916; fixed at 11.0.0.8916	CNA record
Hancom Inc. Hancom Office 2022 hancom:office_2022 (from the name)	before 12.0.0.4426; fixed at 12.0.0.4426	CNA record
Hancom Inc. Hancom Office 2024 hancom:office_2024 (from the name)	before 13.0.0.3050; fixed at 13.0.0.3050	CNA record

References

References

https://www.boho.or.kr/kr/bbs/view.do?searchCnd=&bbsId=B0000302&searchWrd=&menuNo=205023&pageIndex=1&categoryCode=&nttId=71959
https://www.hancom.com/support/downloadCenter/download

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.