Live › vulnerability › CVE-2026-118040
Go to dashboardTelerik Document Processing Libraries before 2026.3.1027 fail to properly verify PDF digital signatures and certificate chains in RadPdfProcessing. A crafted signed PDF can make the library report forged content as unmodified and its signing certificate as valid.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Applications that use the Telerik Document Processing Libraries, specifically RadPdfProcessing, to validate digital signatures on PDF documents that come from outside the organization. Systems that only generate PDFs or never check signatures are less exposed. The sources do not say whether specific deployment configurations change exposure.
No product ranges from the sources yet.
Telerik.Documents.Core in the .csproj) and compare it against 2026.3.10272026.3.1027 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticated attacker to cause signature validation to report forged content as unmodified and its signing certificate as valid via a crafted signed PDF document.
This page as .md · .json · in your agent: get_signal("CVE-2026-118040")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.