{"id":"CVE-2026-124699","kind":"vulnerability","aliases":["CVE-2026-124699"],"related":[],"title":"Telerik UI for WinForms: crafted expression runs unauthorized code in apps","description":"In Telerik UI for WinForms, versions prior to 2026.4.1111, an improper control of code generation vulnerability exists that allows an attacker to supply a crafted expression and execute unauthorized code in the context of the affected application.","summary":"Telerik UI for WinForms, a component library for Windows desktop apps, fails to control code generation from expressions. An attacker who supplies a crafted expression can run unauthorized code inside the affected application.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dotnet","package","telerik","windows","winforms"],"not_affected_if":["version-2026.4.1111-or-later"],"how_to_check":"- Check the Telerik.UI.for.WinForms version referenced in your project files (for example in `packages.config` or the `.csproj` package references).\n- Confirm whether the version is earlier than `2026.4.1111`.","fix":"- Telerik UI for WinForms: move to `2026.4.1111` or later.","status":"open","published_at":"2026-11-12T10:17:28+00:00","first_seen_at":"2026-11-12T10:37:45+00:00","triaged_at":"2026-11-12T10:39:39+00:00","updated_at":"2026-11-12T10:39:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T10:39:39Z","model":"claude-haiku-5-5","output":{"fix":"- Telerik UI for WinForms: move to `2026.4.1111` or later.","reach":"unknown","title":"Telerik UI for WinForms: crafted expression runs unauthorized code in apps","impact":"high","summary":"Telerik UI for WinForms, a component library for Windows desktop apps, fails to control code generation from expressions. An attacker who supplies a crafted expression can run unauthorized code inside the affected application.","audience":"developers","category":"package","nicknames":[],"who_cares":["winforms","telerik","windows","dotnet"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs unauthorized code within the affected application","analyst_note":"Check the NVD entry and the Telerik release notes to confirm which inputs and controls reach the expression code path and whether the attack needs network access.","how_to_check":"- Check the Telerik.UI.for.WinForms version referenced in your project files (for example in `packages.config` or the `.csproj` package references).\n- Confirm whether the version is earlier than `2026.4.1111`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-2026.4.1111-or-later"],"who_is_affected":"Any Windows Forms application that uses a Telerik UI for WinForms version before 2026.4.1111 and passes expressions that can reach the vulnerable code path. The sources do not say which features or inputs trigger the flaw, so review where expressions come from in your app. Applications on newer versions are not affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4532,"output_tokens":569,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124699':14A,17A '-2026':13A,16A '2026.4.1111':64C 'affect':54B,91C 'allow':74C 'app':11A,33B 'applic':55B,92C 'attack':42B,76C 'code':9A,37B,51B,69C,85C 'compon':28B 'context':88C 'control':36B,67C 'craft':5A,46B,80C 'cve':12A,15A 'desktop':32B 'dotnet':18B 'execut':83C 'exist':72C 'express':6A,40B,47B,81C 'fail':34B 'generat':38B,70C 'improp':66C 'insid':52B 'librari':29B 'packag':19B 'prior':62C 'run':7A,49B 'suppli':44B,78C 'telerik':1A,20B,23B,57C 'ui':2A,24B,58C 'unauthor':8A,50B,84C 'version':61C 'vulner':71C 'window':21B,31B 'winform':4A,22B,26B,60C","nicknames":[],"mitigations":[],"who_affected":"Any Windows Forms application that uses a Telerik UI for WinForms version before 2026.4.1111 and passes expressions that can reach the vulnerable code path. The sources do not say which features or inputs trigger the flaw, so review where expressions come from in your app. Applications on newer versions are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dotnet","high","package","telerik","windows","winforms"],"campaign_type":null,"search_a":"'-124699':14A,17A '-2026':13A,16A 'app':11A 'code':9A 'craft':5A 'cve':12A,15A 'express':6A 'run':7A 'telerik':1A 'ui':2A 'unauthor':8A 'winform':4A","search_b":"'affect':54B 'app':33B 'applic':55B 'attack':42B 'code':37B,51B 'compon':28B 'control':36B 'craft':46B 'desktop':32B 'dotnet':18B 'express':40B,47B 'fail':34B 'generat':38B 'insid':52B 'librari':29B 'packag':19B 'run':49B 'suppli':44B 'telerik':20B,23B 'ui':24B 'unauthor':50B 'window':21B,31B 'winform':22B,26B","search_c":"'2026.4.1111':64C 'affect':91C 'allow':74C 'applic':92C 'attack':76C 'code':69C,85C 'context':88C 'control':67C 'craft':80C 'execut':83C 'exist':72C 'express':81C 'generat':70C 'improp':66C 'prior':62C 'suppli':78C 'telerik':57C 'ui':58C 'unauthor':84C 'version':61C 'vulner':71C 'winform':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T10:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124699","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124699","severity":null,"published_at":"2026-11-12T10:17:28+00:00","modified_at":"2026-11-12T10:17:28+00:00","first_seen_at":"2026-11-12T10:37:45+00:00","fetched_at":"2026-11-12T10:37:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}