Live › vulnerability › CVE-2026-118035
Go to dashboardTelerik Document Processing Libraries before 2026.3.1027 have uncontrolled recursion and infinite loop flaws in RadWordsProcessing. An unauthenticated attacker who supplies a crafted DOCX, DOC, RTF or HTML document can terminate or hang the process that parses it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Applications that use RadWordsProcessing to parse Word, RTF or HTML documents that come from users or other untrusted sources are exposed. Services that only process internal, trusted documents or do not use these libraries can skip it.
No product ranges from the sources yet.
2026.3.1027.2026.3.1027 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in RadWordsProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted DOCX, DOC, RTF or HTML document.
This page as .md · .json · in your agent: get_signal("CVE-2026-118035")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.