{"id":"CVE-2026-124702","kind":"vulnerability","aliases":["CVE-2026-124702"],"related":[],"title":"Telerik UI for WPF: crafted links launch OS protocol handlers with attacker arguments","description":"In Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens.","summary":"Telerik UI for WPF, a .NET component library, opens hyperlinks in documents without checking the URI scheme against an allowlist. A user who opens a crafted document or hyperlink can have the operating system launch an arbitrary protocol handler with attacker-controlled arguments.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dotnet","package","telerik","windows","wpf"],"not_affected_if":["no-untrusted-content","patched-version"],"how_to_check":"- Find the Telerik UI for WPF package version in your .NET project files (for example `Telerik.Windows.Controls` in `.csproj` or `packages.config`)\n- Check whether your application renders user-supplied documents or hyperlinks with Telerik controls","fix":"- Telerik UI for WPF: move to `2026.4.1110` or later","status":"open","published_at":"2026-11-12T18:17:22+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","triaged_at":"2026-11-12T18:42:45+00:00","updated_at":"2026-11-12T18:42:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T18:42:45Z","model":"claude-haiku-5-5","output":{"fix":"- Telerik UI for WPF: move to `2026.4.1110` or later","reach":"local","title":"Telerik UI for WPF: crafted links launch OS protocol handlers with attacker arguments","impact":"high","summary":"Telerik UI for WPF, a .NET component library, opens hyperlinks in documents without checking the URI scheme against an allowlist. A user who opens a crafted document or hyperlink can have the operating system launch an arbitrary protocol handler with attacker-controlled arguments.","audience":"developers","category":"package","nicknames":[],"who_cares":["wpf","dotnet","telerik","windows"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Arbitrary protocol handlers run on the user's machine with attacker arguments","analyst_note":"","how_to_check":"- Find the Telerik UI for WPF package version in your .NET project files (for example `Telerik.Windows.Controls` in `.csproj` or `packages.config`)\n- Check whether your application renders user-supplied documents or hyperlinks with Telerik controls","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","no-untrusted-content"],"who_is_affected":"Applications built with Telerik UI for WPF before version 2026.4.1110 that display documents or hyperlinks from untrusted sources are exposed. The attack needs a user to open a crafted link or document, so desktop apps that only show trusted content carry less risk.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000735,"input_tokens":4573,"output_tokens":556,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124702':16A,19A '-2026':15A,18A '2026.4.1110':77C 'allow':85C 'allowlist':44B,109C 'arbitrari':61B,90C 'argument':13A,68B,99C 'attack':12A,66B,87C,97C 'attacker-control':65B,96C 'check':38B 'compon':31B 'control':67B,98C 'craft':5A,50B,101C 'cve':14A,17A 'document':36B,51B,102C 'dotnet':20B 'exist':83C 'handler':10A,63B,94C 'hyperlink':34B,53B,104C 'launch':7A,59B,89C 'librari':32B 'link':6A 'net':30B 'non':108C 'non-allowlist':107C 'open':33B,48B,115C 'oper':57B,91C 'os':8A 'packag':21B 'prior':75C 'protocol':9A,62B,93C 'redirect':81C 'scheme':41B,111C 'system':58B,92C 'telerik':1A,22B,25B,70C 'ui':2A,26B,71C 'untrust':79C 'uri':40B,110C 'url':80C 'user':46B,114C 'version':74C 'via':100C 'vulner':82C 'window':23B 'without':37B 'wpf':4A,24B,28B,73C","nicknames":[],"mitigations":[],"who_affected":"Applications built with Telerik UI for WPF before version 2026.4.1110 that display documents or hyperlinks from untrusted sources are exposed. The attack needs a user to open a crafted link or document, so desktop apps that only show trusted content carry less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dotnet","high","package","telerik","windows","wpf"],"campaign_type":null,"search_a":"'-124702':16A,19A '-2026':15A,18A 'argument':13A 'attack':12A 'craft':5A 'cve':14A,17A 'handler':10A 'launch':7A 'link':6A 'os':8A 'protocol':9A 'telerik':1A 'ui':2A 'wpf':4A","search_b":"'allowlist':44B 'arbitrari':61B 'argument':68B 'attack':66B 'attacker-control':65B 'check':38B 'compon':31B 'control':67B 'craft':50B 'document':36B,51B 'dotnet':20B 'handler':63B 'hyperlink':34B,53B 'launch':59B 'librari':32B 'net':30B 'open':33B,48B 'oper':57B 'packag':21B 'protocol':62B 'scheme':41B 'system':58B 'telerik':22B,25B 'ui':26B 'uri':40B 'user':46B 'window':23B 'without':37B 'wpf':24B,28B","search_c":"'2026.4.1110':77C 'allow':85C 'allowlist':109C 'arbitrari':90C 'argument':99C 'attack':87C,97C 'attacker-control':96C 'control':98C 'craft':101C 'document':102C 'exist':83C 'handler':94C 'hyperlink':104C 'launch':89C 'non':108C 'non-allowlist':107C 'open':115C 'oper':91C 'prior':75C 'protocol':93C 'redirect':81C 'scheme':111C 'system':92C 'telerik':70C 'ui':71C 'untrust':79C 'uri':110C 'url':80C 'user':114C 'version':74C 'via':100C 'vulner':82C 'wpf':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124702","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124702","severity":null,"published_at":"2026-11-12T18:17:22+00:00","modified_at":"2026-11-12T18:17:22+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","fetched_at":"2026-11-12T18:40:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}