---
id: "CVE-2026-124701"
page: "https://infrastack.ai/live/CVE-2026-124701"
kind: "vulnerability"
aliases: ["CVE-2026-124701"]
title: "Telerik UI for WinForms: untrusted data deserialization lets attackers act as the app"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dotnet", "package", "telerik", "windows", "winforms"]
not_affected_if: ["not-using-telerik-winforms", "trusted-input-only"]
published_at: "2026-11-12T11:17:10+00:00"
first_seen_at: "2026-11-12T11:38:04+00:00"
updated_at: "2026-11-12T11:40:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124701", "first_seen_at": "2026-11-12T11:38:04+00:00"}]
exploit_sources: []
---

# Telerik UI for WinForms: untrusted data deserialization lets attackers act as the app

Link for people: https://infrastack.ai/live/CVE-2026-124701 (this .md is for agents)

Telerik UI for WinForms, a component library for Windows desktop apps, deserializes untrusted data in versions before 2026.4.1111. An attacker who can supply that data can perform unauthorized actions in the context of the affected application.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Telerik UI for WinForms version in the project's package references or installed NuGet packages against `2026.4.1111`
- Look for the Telerik.WinControls package in the solution's packages.config or .csproj files

## Fix

- Telerik UI for WinForms: move to `2026.4.1111` or later

## Timeline

- 2026-11-12T11:38:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124701

## From the sources

In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_