CVE-2026-106140 · Package
NO FIX YET · SEE WHAT TO DO
Telerik Reporting versions before 20.3.26.1110 deserialize untrusted data in the .NET Framework report designers. A local attacker with low privileges can execute arbitrary code in the designer process when a user performs certain editing operations.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that use the Telerik Reporting report designers in .NET Framework applications. The risk is local: an attacker needs an account on the machine and a user must perform certain editing operations in the designer. Teams that do not ship or run the designers can skip it.
Not affected if designers-not-used, versions-at-or-above-20.3.26.1110
Who cares .net-framework, telerik-reporting, windows
20.3.26.111020.3.26.1110 or laterIn Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.