CVE-2026-124700 · Package
NO FIX YET · SEE WHAT TO DO
Telerik UI for WinForms opens hyperlinks in documents without restricting the URI scheme, so a crafted link can start any operating system protocol handler with attacker-chosen arguments. The attacker gets to run local programs on the user's machine once the user opens the document or link.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Windows desktop applications built with Telerik UI for WinForms that display documents or hyperlinks from users or external sources are exposed. Applications that never render untrusted documents or links, or that already run on a fixed version, can skip it.
Not affected if fixed-version, no-untrusted-documents
Who cares dotnet, telerik, windows, winforms
2026.4.1111.Process.Start.2026.4.1111 or later.In Telerik UI for WinForms, versions prior to 2026.4.1111, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.