CVE-2026-124699 · Package
NO FIX YET · SEE WHAT TO DO
Telerik UI for WinForms, a component library for Windows desktop apps, fails to control code generation from expressions. An attacker who supplies a crafted expression can run unauthorized code inside the affected application.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any Windows Forms application that uses a Telerik UI for WinForms version before 2026.4.1111 and passes expressions that can reach the vulnerable code path. The sources do not say which features or inputs trigger the flaw, so review where expressions come from in your app. Applications on newer versions are not affected.
Not affected if version-2026.4.1111-or-later
Who cares dotnet, telerik, windows, winforms
packages.config or the .csproj package references).2026.4.1111.2026.4.1111 or later.In Telerik UI for WinForms, versions prior to 2026.4.1111, an improper control of code generation vulnerability exists that allows an attacker to supply a crafted expression and execute unauthorized code in the context of the affected application.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.