hwpapp.dll in Hangul Word Processor allows remote attackers to execute arbitrary code via a crafted heap spray and by leveraging a \type confusion\ via an HWPX file containing a crafted para text tag.