---
id: "CVE-2026-118037"
kind: "vulnerability"
aliases: ["CVE-2026-118037"]
title: "Telerik Document Processing: crafted spreadsheet can crash or hang the host process"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: [".net", "document-processing", "file-upload", "package", "telerik"]
not_affected_if: ["no-spreadsheet-parsing", "trusted-files-only"]
published_at: "2026-10-28T13:17:06+00:00"
first_seen_at: "2026-10-28T13:33:01+00:00"
updated_at: "2026-10-28T13:34:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118037", "first_seen_at": "2026-10-28T13:33:01+00:00"}]
---

# Telerik Document Processing: crafted spreadsheet can crash or hang the host process

Telerik Document Processing Libraries before 2026.3.1027 mishandle crafted XLSX or XLS workbooks and formulas in RadSpreadProcessing and RadSpreadStreamProcessing, causing uncontrolled recursion and infinite loops. An unauthenticated attacker who gets a crafted file processed can terminate or hang the application process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the Telerik Document Processing Libraries package (Telerik.Documents.Spreadsheet or the RadSpreadProcessing/RadSpreadStreamProcessing types) in the project's NuGet packages and check its version against `2026.3.1027`.
- Check whether the application parses uploaded or external XLSX/XLS files with these classes.

## Fix

- Upgrade Telerik Document Processing Libraries to `2026.3.1027` or later.
- Until upgraded, reject or limit untrusted spreadsheet uploads before they reach RadSpreadProcessing.

## Timeline

- 2026-10-28T13:33:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118037

## From the sources

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular expression vulnerabilities in RadSpreadProcessing and RadSpreadStreamProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted XLSX or XLS workbook or formula.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_