{"id":"CVE-2026-124700","kind":"vulnerability","aliases":["CVE-2026-124700"],"related":[],"title":"Telerik UI for WinForms: crafted links launch arbitrary OS protocol handlers","description":"In Telerik UI for WinForms, versions prior to 2026.4.1111, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens.","summary":"Telerik UI for WinForms opens hyperlinks in documents without restricting the URI scheme, so a crafted link can start any operating system protocol handler with attacker-chosen arguments. The attacker gets to run local programs on the user's machine once the user opens the document or link.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dotnet","package","telerik","windows","winforms"],"not_affected_if":["fixed-version","no-untrusted-documents"],"how_to_check":"- Check the Telerik.UI.for.WinForms package version in the project file or NuGet packages list against `2026.4.1111`.\n- Search the application's code for hyperlink or document-open handling that passes URIs to the shell or `Process.Start`.","fix":"- Telerik UI for WinForms: move to `2026.4.1111` or later.","status":"open","published_at":"2026-11-12T18:17:22+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","triaged_at":"2026-11-12T18:42:47+00:00","updated_at":"2026-11-12T18:42:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T18:42:47Z","model":"claude-haiku-5-5","output":{"fix":"- Telerik UI for WinForms: move to `2026.4.1111` or later.","reach":"local","title":"Telerik UI for WinForms: crafted links launch arbitrary OS protocol handlers","impact":"high","summary":"Telerik UI for WinForms opens hyperlinks in documents without restricting the URI scheme, so a crafted link can start any operating system protocol handler with attacker-chosen arguments. The attacker gets to run local programs on the user's machine once the user opens the document or link.","audience":"developers","category":"package","nicknames":[],"who_cares":["winforms","telerik","windows","dotnet"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs local programs with arguments on the user's machine","analyst_note":"Confirm the affected package ID and NuGet range for Telerik UI for WinForms and whether the fix is in the 2026.4.1111 release notes at the Telerik site.","how_to_check":"- Check the Telerik.UI.for.WinForms package version in the project file or NuGet packages list against `2026.4.1111`.\n- Search the application's code for hyperlink or document-open handling that passes URIs to the shell or `Process.Start`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fixed-version","no-untrusted-documents"],"who_is_affected":"Windows desktop applications built with Telerik UI for WinForms that display documents or hyperlinks from users or external sources are exposed. Applications that never render untrusted documents or links, or that already run on a fixed version, can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4573,"output_tokens":606,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124700':14A,17A '-2026':13A,16A '2026.4.1111':80C 'allow':88C 'allowlist':112C 'arbitrari':8A,93C 'argument':51B,102C 'attack':49B,53B,90C,100C 'attacker-chosen':48B 'attacker-control':99C 'chosen':50B 'control':101C 'craft':5A,38B,104C 'cve':12A,15A 'document':30B,69B,105C 'dotnet':18B 'exist':86C 'get':54B 'handler':11A,46B,97C 'hyperlink':28B,107C 'launch':7A,92C 'link':6A,39B,71B 'local':57B 'machin':63B 'non':111C 'non-allowlist':110C 'open':27B,67B,118C 'oper':43B,94C 'os':9A 'packag':19B 'prior':78C 'program':58B 'protocol':10A,45B,96C 'redirect':84C 'restrict':32B 'run':56B 'scheme':35B,114C 'start':41B 'system':44B,95C 'telerik':1A,20B,23B,73C 'ui':2A,24B,74C 'untrust':82C 'uri':34B,113C 'url':83C 'user':61B,66B,117C 'version':77C 'via':103C 'vulner':85C 'window':21B 'winform':4A,22B,26B,76C 'without':31B","nicknames":[],"mitigations":[],"who_affected":"Windows desktop applications built with Telerik UI for WinForms that display documents or hyperlinks from users or external sources are exposed. Applications that never render untrusted documents or links, or that already run on a fixed version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dotnet","high","package","telerik","windows","winforms"],"campaign_type":null,"search_a":"'-124700':14A,17A '-2026':13A,16A 'arbitrari':8A 'craft':5A 'cve':12A,15A 'handler':11A 'launch':7A 'link':6A 'os':9A 'protocol':10A 'telerik':1A 'ui':2A 'winform':4A","search_b":"'argument':51B 'attack':49B,53B 'attacker-chosen':48B 'chosen':50B 'craft':38B 'document':30B,69B 'dotnet':18B 'get':54B 'handler':46B 'hyperlink':28B 'link':39B,71B 'local':57B 'machin':63B 'open':27B,67B 'oper':43B 'packag':19B 'program':58B 'protocol':45B 'restrict':32B 'run':56B 'scheme':35B 'start':41B 'system':44B 'telerik':20B,23B 'ui':24B 'uri':34B 'user':61B,66B 'window':21B 'winform':22B,26B 'without':31B","search_c":"'2026.4.1111':80C 'allow':88C 'allowlist':112C 'arbitrari':93C 'argument':102C 'attack':90C,100C 'attacker-control':99C 'control':101C 'craft':104C 'document':105C 'exist':86C 'handler':97C 'hyperlink':107C 'launch':92C 'non':111C 'non-allowlist':110C 'open':118C 'oper':94C 'prior':78C 'protocol':96C 'redirect':84C 'scheme':114C 'system':95C 'telerik':73C 'ui':74C 'untrust':82C 'uri':113C 'url':83C 'user':117C 'version':77C 'via':103C 'vulner':85C 'winform':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124700","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124700","severity":null,"published_at":"2026-11-12T18:17:22+00:00","modified_at":"2026-11-12T18:17:22+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","fetched_at":"2026-11-12T18:40:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}