{"id":"CVE-2026-118037","kind":"vulnerability","aliases":["CVE-2026-118037"],"related":[],"title":"Telerik Document Processing: crafted spreadsheet can crash or hang the host process","description":"In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular expression vulnerabilities in RadSpreadProcessing and RadSpreadStreamProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted XLSX or XLS workbook or formula.","summary":"Telerik Document Processing Libraries before 2026.3.1027 mishandle crafted XLSX or XLS workbooks and formulas in RadSpreadProcessing and RadSpreadStreamProcessing, causing uncontrolled recursion and infinite loops. An unauthenticated attacker who gets a crafted file processed can terminate or hang the application process.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":[".net","document-processing","file-upload","package","telerik"],"not_affected_if":["no-spreadsheet-parsing","trusted-files-only"],"how_to_check":"- Look for the Telerik Document Processing Libraries package (Telerik.Documents.Spreadsheet or the RadSpreadProcessing/RadSpreadStreamProcessing types) in the project's NuGet packages and check its version against `2026.3.1027`.\n- Check whether the application parses uploaded or external XLSX/XLS files with these classes.","fix":"- Upgrade Telerik Document Processing Libraries to `2026.3.1027` or later.\n- Until upgraded, reject or limit untrusted spreadsheet uploads before they reach RadSpreadProcessing.","status":"open","published_at":"2026-10-28T13:17:06+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:34:04+00:00","updated_at":"2026-10-28T13:34:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T13:34:04Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Telerik Document Processing Libraries to `2026.3.1027` or later.\n- Until upgraded, reject or limit untrusted spreadsheet uploads before they reach RadSpreadProcessing.","reach":"internet","title":"Telerik Document Processing: crafted spreadsheet can crash or hang the host process","impact":"medium","summary":"Telerik Document Processing Libraries before 2026.3.1027 mishandle crafted XLSX or XLS workbooks and formulas in RadSpreadProcessing and RadSpreadStreamProcessing, causing uncontrolled recursion and infinite loops. An unauthenticated attacker who gets a crafted file processed can terminate or hang the application process.","category":"package","nicknames":[],"who_cares":[".net","telerik","document-processing","file-upload"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker crashes or hangs the application process via crafted spreadsheet","analyst_note":"Check the vendor advisory for affected component details and whether a workaround exists short of upgrading; the NVD entry gives no exploitation or setup detail.","how_to_check":"- Look for the Telerik Document Processing Libraries package (Telerik.Documents.Spreadsheet or the RadSpreadProcessing/RadSpreadStreamProcessing types) in the project's NuGet packages and check its version against `2026.3.1027`.\n- Check whether the application parses uploaded or external XLSX/XLS files with these classes.","needs_analyst":true,"not_affected_if":["no-spreadsheet-parsing","trusted-files-only"],"who_is_affected":"Applications that use Telerik Document Processing Libraries to read XLSX or XLS files, especially where a user or external system can supply the file. Exposure comes from the file-parsing path, so apps that never open spreadsheets from untrusted sources have lower risk. Teams that do not use this library can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000691,"input_tokens":3364,"output_tokens":710,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118037':15A,18A '-2026':14A,17A '2026.3.1027':33B,77C 'allow':94C 'applic':66B 'attack':54B,97C 'caus':46B 'condit':84C 'craft':4A,35B,58B,107C 'crash':7A 'cve':13A,16A 'document':2A,21B,29B,71C 'document-process':20B 'express':88C 'file':24B,59B 'file-upload':23B 'formula':41B,113C 'get':56B 'hang':9A,64B,101C 'host':11A,103C 'ineffici':86C 'infinit':50B,80C 'librari':31B,73C 'loop':51B,81C,83C 'mishandl':34B 'net':19B 'packag':26B 'prior':74C 'process':3A,12A,22B,30B,60B,67B,72C,104C 'progress':69C 'radspreadprocess':43B,91C 'radspreadstreamprocess':45B,93C 'recurs':48B,79C 'regular':87C 'spreadsheet':5A 'telerik':1A,27B,28B,70C 'termin':62B,99C 'unauthent':53B,96C 'uncheck':82C 'uncontrol':47B,78C 'upload':25B 'version':76C 'via':105C 'vulner':89C 'workbook':39B,111C 'xls':38B,110C 'xlsx':36B,108C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Telerik Document Processing Libraries to read XLSX or XLS files, especially where a user or external system can supply the file. Exposure comes from the file-parsing path, so apps that never open spreadsheets from untrusted sources have lower risk. Teams that do not use this library can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118037","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118037","severity":null,"published_at":"2026-10-28T13:17:06+00:00","modified_at":"2026-10-28T13:17:06+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}