TL;DR

A critical vulnerability in Hancom Office allows remote code execution via malicious DOC files, rated CVSS 7.8 by ZDI.

What happened

["Vulnerability found in Hancom Office's DOC file parsing"]

Why it matters for ops

['Allows remote attackers to execute arbitrary code with user interaction']

Mitigation

  • Update to latest version of Hancom Office
  • Disable DOC file parsing if not necessary

Action items

  • Apply security patches
  • Monitor network for suspicious activity

Detection IOCs

  • Unusual network traffic patterns
  • Malicious DOC files

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-047/