{"id":"CVE-2026-124701","kind":"vulnerability","aliases":["CVE-2026-124701"],"related":[],"title":"Telerik UI for WinForms: untrusted data deserialization lets attackers act as the app","description":"In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.","summary":"Telerik UI for WinForms, a component library for Windows desktop apps, deserializes untrusted data in versions before 2026.4.1111. An attacker who can supply that data can perform unauthorized actions in the context of the affected application.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dotnet","package","telerik","windows","winforms"],"not_affected_if":["not-using-telerik-winforms","trusted-input-only"],"how_to_check":"- Check the Telerik UI for WinForms version in the project's package references or installed NuGet packages against `2026.4.1111`\n- Look for the Telerik.WinControls package in the solution's packages.config or .csproj files","fix":"- Telerik UI for WinForms: move to `2026.4.1111` or later","status":"open","published_at":"2026-11-12T11:17:10+00:00","first_seen_at":"2026-11-12T11:38:04+00:00","triaged_at":"2026-11-12T11:40:02+00:00","updated_at":"2026-11-12T11:40:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T11:40:02Z","model":"claude-haiku-5-5","output":{"fix":"- Telerik UI for WinForms: move to `2026.4.1111` or later","reach":"unknown","title":"Telerik UI for WinForms: untrusted data deserialization lets attackers act as the app","impact":"medium","summary":"Telerik UI for WinForms, a component library for Windows desktop apps, deserializes untrusted data in versions before 2026.4.1111. An attacker who can supply that data can perform unauthorized actions in the context of the affected application.","audience":"developers","category":"package","nicknames":[],"who_cares":["telerik","winforms","dotnet","windows"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker performs unauthorized actions inside the affected application","analyst_note":"Check the NVD entry and Telerik release notes for the triggering feature, required access and attack vector; the sources give only the one-line description.","how_to_check":"- Check the Telerik UI for WinForms version in the project's package references or installed NuGet packages against `2026.4.1111`\n- Look for the Telerik.WinControls package in the solution's packages.config or .csproj files","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-using-telerik-winforms","trusted-input-only"],"who_is_affected":"Windows desktop applications built with Telerik UI for WinForms before 2026.4.1111 are exposed where they deserialize data from an untrusted source. Applications that do not use this library, or that only handle data from trusted sources, are less exposed. The sources do not say which features trigger the deserialization.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000746,"input_tokens":4532,"output_tokens":585,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124701':16A,19A '-2026':15A,18A '2026.4.1111':42B,69C 'act':10A 'action':53B,84C 'affect':59B,90C 'allow':78C 'app':13A,35B 'applic':60B,91C 'attack':9A,44B,80C 'compon':30B 'context':56B,87C 'cve':14A,17A 'data':6A,38B,49B,74C 'deseri':7A,36B,71C 'desktop':34B 'dotnet':20B 'exist':76C 'let':8A 'librari':31B 'packag':21B 'perform':51B,82C 'prior':67C 'suppli':47B 'telerik':1A,22B,25B,62C 'ui':2A,26B,63C 'unauthor':52B,83C 'untrust':5A,37B,73C 'version':40B,66C 'vulner':75C 'window':23B,33B 'winform':4A,24B,28B,65C","nicknames":[],"mitigations":[],"who_affected":"Windows desktop applications built with Telerik UI for WinForms before 2026.4.1111 are exposed where they deserialize data from an untrusted source. Applications that do not use this library, or that only handle data from trusted sources, are less exposed. The sources do not say which features trigger the deserialization.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dotnet","high","package","telerik","windows","winforms"],"campaign_type":null,"search_a":"'-124701':16A,19A '-2026':15A,18A 'act':10A 'app':13A 'attack':9A 'cve':14A,17A 'data':6A 'deseri':7A 'let':8A 'telerik':1A 'ui':2A 'untrust':5A 'winform':4A","search_b":"'2026.4.1111':42B 'action':53B 'affect':59B 'app':35B 'applic':60B 'attack':44B 'compon':30B 'context':56B 'data':38B,49B 'deseri':36B 'desktop':34B 'dotnet':20B 'librari':31B 'packag':21B 'perform':51B 'suppli':47B 'telerik':22B,25B 'ui':26B 'unauthor':52B 'untrust':37B 'version':40B 'window':23B,33B 'winform':24B,28B","search_c":"'2026.4.1111':69C 'action':84C 'affect':90C 'allow':78C 'applic':91C 'attack':80C 'context':87C 'data':74C 'deseri':71C 'exist':76C 'perform':82C 'prior':67C 'telerik':62C 'ui':63C 'unauthor':83C 'untrust':73C 'version':66C 'vulner':75C 'winform':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T11:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124701","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124701","severity":null,"published_at":"2026-11-12T11:17:10+00:00","modified_at":"2026-11-12T11:17:10+00:00","first_seen_at":"2026-11-12T11:38:04+00:00","fetched_at":"2026-11-12T11:38:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}