CVE-2026-124702 · Package
NO FIX YET · SEE WHAT TO DO
Telerik UI for WPF, a .NET component library, opens hyperlinks in documents without checking the URI scheme against an allowlist. A user who opens a crafted document or hyperlink can have the operating system launch an arbitrary protocol handler with attacker-controlled arguments.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications built with Telerik UI for WPF before version 2026.4.1110 that display documents or hyperlinks from untrusted sources are exposed. The attack needs a user to open a crafted link or document, so desktop apps that only show trusted content carry less risk.
Not affected if no-untrusted-content, patched-version
Who cares dotnet, telerik, windows, wpf
Telerik.Windows.Controls in .csproj or packages.config)2026.4.1110 or laterIn Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.