{"id":"CVE-2026-118040","kind":"vulnerability","aliases":["CVE-2026-118040"],"related":[],"title":"Telerik Document Processing: forged PDF signatures reported as valid and unmodified","description":"In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticated attacker to cause signature validation to report forged content as unmodified and its signing certificate as valid via a crafted signed PDF document.","summary":"Telerik Document Processing Libraries before 2026.3.1027 fail to properly verify PDF digital signatures and certificate chains in RadPdfProcessing. A crafted signed PDF can make the library report forged content as unmodified and its signing certificate as valid.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["document-signing","dotnet","package","pdf","telerik"],"not_affected_if":["no-pdf-signature-validation","pdfs-not-trusted-by-signature"],"how_to_check":"- Check the installed Telerik.Documents.Core or Telerik Document Processing package version in the project file (for example `Telerik.Documents.Core` in the .csproj) and compare it against `2026.3.1027`\n- Search the codebase for RadPdfProcessing signature validation calls and whether their results gate trust decisions","fix":"- Upgrade Telerik Document Processing Libraries to `2026.3.1027` or later\n- Until upgraded, do not rely on RadPdfProcessing signature validation results for trust decisions on untrusted PDFs","status":"open","published_at":"2026-10-28T13:17:06+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:34:02+00:00","updated_at":"2026-10-28T13:34:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T13:34:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Telerik Document Processing Libraries to `2026.3.1027` or later\n- Until upgraded, do not rely on RadPdfProcessing signature validation results for trust decisions on untrusted PDFs","reach":"internet","title":"Telerik Document Processing: forged PDF signatures reported as valid and unmodified","impact":"medium","summary":"Telerik Document Processing Libraries before 2026.3.1027 fail to properly verify PDF digital signatures and certificate chains in RadPdfProcessing. A crafted signed PDF can make the library report forged content as unmodified and its signing certificate as valid.","category":"package","nicknames":[],"who_cares":["dotnet","telerik","pdf","document-signing"],"confidence":0.6,"needs_auth":"no","worst_case":"forged PDF content passes as an unmodified, validly signed document","analyst_note":"Check the NVD entry and the Progress vendor advisory for affected version ranges, exact API calls affected, and whether any default configuration is involved.","how_to_check":"- Check the installed Telerik.Documents.Core or Telerik Document Processing package version in the project file (for example `Telerik.Documents.Core` in the .csproj) and compare it against `2026.3.1027`\n- Search the codebase for RadPdfProcessing signature validation calls and whether their results gate trust decisions","needs_analyst":true,"not_affected_if":["no-pdf-signature-validation","pdfs-not-trusted-by-signature"],"who_is_affected":"Applications that use the Telerik Document Processing Libraries, specifically RadPdfProcessing, to validate digital signatures on PDF documents that come from outside the organization. Systems that only generate PDFs or never check signatures are less exposed. The sources do not say whether specific deployment configurations change exposure.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000669,"input_tokens":3337,"output_tokens":670,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118040':14A,17A '-2026':13A,16A '2026.3.1027':30B,71C 'allow':86C 'attack':89C 'caus':91C 'certif':39B,59B,79C,103C 'chain':40B 'content':53B,97C 'craft':44B,108C 'cryptograph':75C 'cve':12A,15A 'digit':36B,83C 'document':2A,19B,26B,65C,111C 'document-sign':18B 'dotnet':21B 'fail':31B 'forg':4A,52B,96C 'improp':72C,78C 'librari':28B,50B,67C 'make':48B 'packag':22B 'pdf':5A,23B,35B,46B,110C 'prior':68C 'process':3A,27B,66C 'progress':63C 'proper':33B 'radpdfprocess':42B,82C 'report':7A,51B,95C 'sign':20B,45B,58B,102C,109C 'signatur':6A,37B,76C,84C,92C 'telerik':1A,24B,25B,64C 'unauthent':88C 'unmodifi':11A,55B,99C 'valid':9A,61B,80C,85C,93C,105C 'verif':73C 'verifi':34B 'version':70C 'via':106C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Telerik Document Processing Libraries, specifically RadPdfProcessing, to validate digital signatures on PDF documents that come from outside the organization. Systems that only generate PDFs or never check signatures are less exposed. The sources do not say whether specific deployment configurations change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118040","severity":null,"published_at":"2026-10-28T13:17:06+00:00","modified_at":"2026-10-28T13:17:06+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}