Live › vulnerability › CVE-2026-118037
Go to dashboardTelerik Document Processing Libraries before 2026.3.1027 mishandle crafted XLSX or XLS workbooks and formulas in RadSpreadProcessing and RadSpreadStreamProcessing, causing uncontrolled recursion and infinite loops. An unauthenticated attacker who gets a crafted file processed can terminate or hang the application process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Applications that use Telerik Document Processing Libraries to read XLSX or XLS files, especially where a user or external system can supply the file. Exposure comes from the file-parsing path, so apps that never open spreadsheets from untrusted sources have lower risk. Teams that do not use this library can skip it.
No product ranges from the sources yet.
2026.3.1027.2026.3.1027 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular expression vulnerabilities in RadSpreadProcessing and RadSpreadStreamProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted XLSX or XLS workbook or formula.
This page as .md · .json · in your agent: get_signal("CVE-2026-118037")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.