CVE-2026-124701 · Package
NO FIX YET · SEE WHAT TO DO
Telerik UI for WinForms, a component library for Windows desktop apps, deserializes untrusted data in versions before 2026.4.1111. An attacker who can supply that data can perform unauthorized actions in the context of the affected application.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Windows desktop applications built with Telerik UI for WinForms before 2026.4.1111 are exposed where they deserialize data from an untrusted source. Applications that do not use this library, or that only handle data from trusted sources, are less exposed. The sources do not say which features trigger the deserialization.
Not affected if not-using-telerik-winforms, trusted-input-only
Who cares dotnet, telerik, windows, winforms
2026.4.11112026.4.1111 or laterIn Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.