{"id":"CVE-2026-118036","kind":"vulnerability","aliases":["CVE-2026-118036"],"related":[],"title":"Telerik Document Processing: crafted PDF can hang or crash the host process","description":"In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or hang the host process via a crafted PDF document or document text submitted for summarization or question answering.","summary":"Telerik Document Processing Libraries before 2026.3.1027 have recursion, infinite loop and resource allocation flaws in RadPdfProcessing and its AI summarization and question answering features. An unauthenticated attacker can hang or terminate the host application by submitting a crafted PDF or document text.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":[".net","document-processing","internet-facing","package","pdf","telerik"],"not_affected_if":["feature-unused","no-untrusted-pdf-input"],"how_to_check":"- Look up the installed Telerik Document Processing Libraries version in the project's package manifest (for example the NuGet package reference for Telerik.Documents.*) and compare it to `2026.3.1027`\n- Check whether the application uses RadPdfProcessing or the AI summarization / question answering features on untrusted input","fix":"- Upgrade Telerik Document Processing Libraries to `2026.3.1027` or later\n- Until upgraded, restrict or reject untrusted PDF uploads and document text sent to summarization or question answering","status":"open","published_at":"2026-10-28T13:17:06+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:34:04+00:00","updated_at":"2026-10-28T13:34:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T13:34:04Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Telerik Document Processing Libraries to `2026.3.1027` or later\n- Until upgraded, restrict or reject untrusted PDF uploads and document text sent to summarization or question answering","reach":"internet","title":"Telerik Document Processing: crafted PDF can hang or crash the host process","impact":"medium","summary":"Telerik Document Processing Libraries before 2026.3.1027 have recursion, infinite loop and resource allocation flaws in RadPdfProcessing and its AI summarization and question answering features. An unauthenticated attacker can hang or terminate the host application by submitting a crafted PDF or document text.","category":"package","nicknames":[],"who_cares":[".net","telerik","document-processing","pdf","internet-facing"],"confidence":0.7,"needs_auth":"no","worst_case":"Host process hangs or terminates from a crafted document","analyst_note":"Check the vendor advisory or NVD entry for which features exactly are affected and whether a DoS-only impact is the full scope.","how_to_check":"- Look up the installed Telerik Document Processing Libraries version in the project's package manifest (for example the NuGet package reference for Telerik.Documents.*) and compare it to `2026.3.1027`\n- Check whether the application uses RadPdfProcessing or the AI summarization / question answering features on untrusted input","needs_analyst":true,"not_affected_if":["no-untrusted-pdf-input","feature-unused"],"who_is_affected":"Applications that pass PDFs or document text from untrusted users into Telerik Document Processing Libraries, especially RadPdfProcessing or its AI summarization and question answering features. Applications that do not use these libraries, or only process trusted internal documents, are much less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000658,"input_tokens":3365,"output_tokens":642,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118036':15A,18A '-2026':14A,17A '2026.3.1027':34B,80C 'ai':47B,95C 'algorithm':86C 'alloc':41B,90C 'allow':101C 'answer':51B,100C,125C 'applic':62B 'attack':55B,104C 'complex':87C 'craft':4A,66B,114C 'crash':9A 'cve':13A,16A 'document':2A,21B,30B,69B,74C,96C,116C,118C 'document-process':20B 'face':25B 'featur':52B 'flaw':42B 'hang':7A,57B,108C 'host':11A,61B,110C 'ineffici':85C 'infinit':37B,83C 'internet':24B 'internet-fac':23B 'librari':32B,76C 'loop':38B,84C 'net':19B 'packag':26B 'pdf':5A,27B,67B,115C 'prior':77C 'process':3A,12A,22B,31B,75C,111C 'progress':72C 'question':50B,99C,124C 'radpdfprocess':44B,93C 'recurs':36B,82C 'resourc':40B,89C 'submit':64B,120C 'summar':48B,97C,122C 'telerik':1A,28B,29B,73C 'termin':59B,106C 'text':70B,119C 'unauthent':54B,103C 'uncontrol':81C 'version':79C 'via':112C 'vulner':91C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass PDFs or document text from untrusted users into Telerik Document Processing Libraries, especially RadPdfProcessing or its AI summarization and question answering features. Applications that do not use these libraries, or only process trusted internal documents, are much less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118036","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118036","severity":null,"published_at":"2026-10-28T13:17:06+00:00","modified_at":"2026-10-28T13:17:06+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}