---
id: "CVE-2026-124700"
page: "https://infrastack.ai/live/CVE-2026-124700"
kind: "vulnerability"
aliases: ["CVE-2026-124700"]
title: "Telerik UI for WinForms: crafted links launch arbitrary OS protocol handlers"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dotnet", "package", "telerik", "windows", "winforms"]
not_affected_if: ["fixed-version", "no-untrusted-documents"]
published_at: "2026-11-12T18:17:22+00:00"
first_seen_at: "2026-11-12T18:40:38+00:00"
updated_at: "2026-11-12T18:42:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124700", "first_seen_at": "2026-11-12T18:40:38+00:00"}]
exploit_sources: []
---

# Telerik UI for WinForms: crafted links launch arbitrary OS protocol handlers

Link for people: https://infrastack.ai/live/CVE-2026-124700 (this .md is for agents)

Telerik UI for WinForms opens hyperlinks in documents without restricting the URI scheme, so a crafted link can start any operating system protocol handler with attacker-chosen arguments. The attacker gets to run local programs on the user's machine once the user opens the document or link.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Telerik.UI.for.WinForms package version in the project file or NuGet packages list against `2026.4.1111`.
- Search the application's code for hyperlink or document-open handling that passes URIs to the shell or `Process.Start`.

## Fix

- Telerik UI for WinForms: move to `2026.4.1111` or later.

## Timeline

- 2026-11-12T18:40:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124700

## From the sources

In Telerik UI for WinForms, versions prior to 2026.4.1111, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_