---
id: "CVE-2026-118036"
kind: "vulnerability"
aliases: ["CVE-2026-118036"]
title: "Telerik Document Processing: crafted PDF can hang or crash the host process"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: [".net", "document-processing", "internet-facing", "package", "pdf", "telerik"]
not_affected_if: ["feature-unused", "no-untrusted-pdf-input"]
published_at: "2026-10-28T13:17:06+00:00"
first_seen_at: "2026-10-28T13:33:01+00:00"
updated_at: "2026-10-28T13:34:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118036", "first_seen_at": "2026-10-28T13:33:01+00:00"}]
---

# Telerik Document Processing: crafted PDF can hang or crash the host process

Telerik Document Processing Libraries before 2026.3.1027 have recursion, infinite loop and resource allocation flaws in RadPdfProcessing and its AI summarization and question answering features. An unauthenticated attacker can hang or terminate the host application by submitting a crafted PDF or document text.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look up the installed Telerik Document Processing Libraries version in the project's package manifest (for example the NuGet package reference for Telerik.Documents.*) and compare it to `2026.3.1027`
- Check whether the application uses RadPdfProcessing or the AI summarization / question answering features on untrusted input

## Fix

- Upgrade Telerik Document Processing Libraries to `2026.3.1027` or later
- Until upgraded, restrict or reject untrusted PDF uploads and document text sent to summarization or question answering

## Timeline

- 2026-10-28T13:33:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118036

## From the sources

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or hang the host process via a crafted PDF document or document text submitted for summarization or question answering.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_