---
id: "CVE-2026-118040"
kind: "vulnerability"
aliases: ["CVE-2026-118040"]
title: "Telerik Document Processing: forged PDF signatures reported as valid and unmodified"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["document-signing", "dotnet", "package", "pdf", "telerik"]
not_affected_if: ["no-pdf-signature-validation", "pdfs-not-trusted-by-signature"]
published_at: "2026-10-28T13:17:06+00:00"
first_seen_at: "2026-10-28T13:33:01+00:00"
updated_at: "2026-10-28T13:34:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118040", "first_seen_at": "2026-10-28T13:33:01+00:00"}]
---

# Telerik Document Processing: forged PDF signatures reported as valid and unmodified

Telerik Document Processing Libraries before 2026.3.1027 fail to properly verify PDF digital signatures and certificate chains in RadPdfProcessing. A crafted signed PDF can make the library report forged content as unmodified and its signing certificate as valid.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Telerik.Documents.Core or Telerik Document Processing package version in the project file (for example `Telerik.Documents.Core` in the .csproj) and compare it against `2026.3.1027`
- Search the codebase for RadPdfProcessing signature validation calls and whether their results gate trust decisions

## Fix

- Upgrade Telerik Document Processing Libraries to `2026.3.1027` or later
- Until upgraded, do not rely on RadPdfProcessing signature validation results for trust decisions on untrusted PDFs

## Timeline

- 2026-10-28T13:33:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118040

## From the sources

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticated attacker to cause signature validation to report forged content as unmodified and its signing certificate as valid via a crafted signed PDF document.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_