{"id":"CVE-2026-118035","kind":"vulnerability","aliases":["CVE-2026-118035"],"related":[],"title":"Telerik Document Processing: crafted DOCX or RTF file crashes or hangs the host","description":"In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in RadWordsProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted DOCX, DOC, RTF or HTML document.","summary":"Telerik Document Processing Libraries before 2026.3.1027 have uncontrolled recursion and infinite loop flaws in RadWordsProcessing. An unauthenticated attacker who supplies a crafted DOCX, DOC, RTF or HTML document can terminate or hang the process that parses it.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["document-processing","dotnet","package","telerik"],"not_affected_if":["no-untrusted-documents","not-using-radwordsprocessing"],"how_to_check":"- Check the Telerik Document Processing Libraries version in your project's package references or lock files against `2026.3.1027`.\n- Find code paths where RadWordsProcessing parses user-uploaded DOCX, DOC, RTF or HTML files.","fix":"- Upgrade Telerik Document Processing Libraries to `2026.3.1027` or later.","status":"open","published_at":"2026-10-28T13:17:06+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:34:06+00:00","updated_at":"2026-10-28T13:34:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T13:34:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Telerik Document Processing Libraries to `2026.3.1027` or later.","reach":"internet","title":"Telerik Document Processing: crafted DOCX or RTF file crashes or hangs the host","impact":"medium","summary":"Telerik Document Processing Libraries before 2026.3.1027 have uncontrolled recursion and infinite loop flaws in RadWordsProcessing. An unauthenticated attacker who supplies a crafted DOCX, DOC, RTF or HTML document can terminate or hang the process that parses it.","category":"package","nicknames":[],"who_cares":["dotnet","telerik","document-processing"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker crashes or hangs the host process via crafted document","analyst_note":"Check the vendor advisory for the exact affected version range and whether a patch-level fix or workaround exists beyond 2026.3.1027.","how_to_check":"- Check the Telerik Document Processing Libraries version in your project's package references or lock files against `2026.3.1027`.\n- Find code paths where RadWordsProcessing parses user-uploaded DOCX, DOC, RTF or HTML files.","needs_analyst":true,"not_affected_if":["no-untrusted-documents","not-using-radwordsprocessing"],"who_is_affected":"Applications that use RadWordsProcessing to parse Word, RTF or HTML documents that come from users or other untrusted sources are exposed. Services that only process internal, trusted documents or do not use these libraries can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000622,"input_tokens":3344,"output_tokens":576,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118035':16A,19A '-2026':15A,18A '2026.3.1027':31B,71C 'algorithm':75C 'allow':83C 'attack':43B,86C 'complex':76C 'craft':4A,47B,96C 'crash':9A 'cve':14A,17A 'doc':49B,98C 'document':2A,21B,27B,53B,65C,102C 'document-process':20B 'docx':5A,48B,97C 'dotnet':23B 'file':8A 'flaw':38B 'hang':11A,57B,90C 'host':13A,92C 'html':52B,101C 'ineffici':74C 'infinit':36B,78C 'librari':29B,67C 'loop':37B,79C 'packag':24B 'pars':61B 'prior':68C 'process':3A,22B,28B,59B,66C,93C 'progress':63C 'radwordsprocess':40B,82C 'recurs':34B,73C 'rtf':7A,50B,99C 'suppli':45B 'telerik':1A,25B,26B,64C 'termin':55B,88C 'unauthent':42B,85C 'uncontrol':33B,72C 'version':70C 'via':94C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Applications that use RadWordsProcessing to parse Word, RTF or HTML documents that come from users or other untrusted sources are exposed. Services that only process internal, trusted documents or do not use these libraries can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118035","severity":null,"published_at":"2026-10-28T13:17:06+00:00","modified_at":"2026-10-28T13:17:06+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}