CVE-2023-50235 is a High severity (CVSS 7.8) stack based buffer overflow in Hancom Office Show, triggered by parsing a crafted PPT file. It can lead to code execution as the current process. ZDI released it as a zero day with no vendor response, so restrict who opens untrusted files.
What's affected
Product: Hancom Office Show, version 11.0.0.6931 in the record. Fixed version: not confirmed. The ZDI advisory is marked as a zero day, and says that from 26 May 2023 ZDI made multiple attempts to contact the vendor through sales and support channels without a reply. The vulnerability was reported to the vendor on 17 November 2023, and the advisory, ZDI-23-1857, was released on 20 December 2023. NVD published the record on 3 May 2024.
The vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, for a score of 7.8. ZDI and NVD agree on the score. ZDI says the target must visit a malicious page or open a malicious file.
How to check if you're exposed
This is desktop software, so the check is an inventory question. Find machines that have Hancom Office installed and read the version from the application's About dialog or from your software management tool.
The record lists one version for this product, 11.0.0.6931. ZDI says it made repeated attempts to reach the vendor from May 2023 and got no response, and the advisory was released as a zero day on 20 December 2023. I did not find a vendor fix in the sources I fetched, so I cannot name a fixed version. Check Hancom's own site for a current release and its notes before relying on an update.
If you cannot patch, the practical question is who can open untrusted PPT files and where.
What to do now
- Inventory every machine with Hancom Office installed, and note the version.
- Check Hancom's site for a newer release and read its release notes for this issue before you rely on it.
- Treat PPT files from outside the organization as untrusted. Do not open them in Hancom Office unless the sender is known and expected.
- Where you can, open untrusted documents in a sandbox or a locked down virtual machine, or convert them with a different tool first.
- Make sure endpoint protection is current on the machines that run the software, and keep standard users without admin rights.
Why it matters
The weakness is CWE-121, a stack based buffer overflow, which the record also maps to CWE-787, out of bounds write. ZDI explains the cause: the parser does not validate the length of data from the file before copying it into a fixed size buffer on the stack. A file that carries more data than the buffer holds writes past its end.
File parsers are a classic place for this bug, because the file is fully controlled by whoever made it, and the format has many fields that carry lengths. The result named in the advisory is code execution in the context of the current process, which means whatever the user can do.
The ZDI mitigation advice is blunt. Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application. KEV status is false, and nothing I read claims exploitation. The free gold.safeguard.sh/scan scan will not find desktop applications, so put them in an asset inventory. The Gold directory lists this CVE with both CWEs.
Quick check
Is there a patch?
I could not confirm one. ZDI says the vendor did not respond when it was contacted, and the advisory was released as a zero day. Check the vendor site for newer releases.
What is the safest way to reduce risk now?
Restrict who opens untrusted PPT files in this application, which is the mitigation ZDI gives, and use a sandbox for documents you must inspect.
Sources
Last reviewed: 19 October 2026.
