---
id: "CVE-2026-124702"
page: "https://infrastack.ai/live/CVE-2026-124702"
kind: "vulnerability"
aliases: ["CVE-2026-124702"]
title: "Telerik UI for WPF: crafted links launch OS protocol handlers with attacker arguments"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dotnet", "package", "telerik", "windows", "wpf"]
not_affected_if: ["no-untrusted-content", "patched-version"]
published_at: "2026-11-12T18:17:22+00:00"
first_seen_at: "2026-11-12T18:40:38+00:00"
updated_at: "2026-11-12T18:42:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124702", "first_seen_at": "2026-11-12T18:40:38+00:00"}]
exploit_sources: []
---

# Telerik UI for WPF: crafted links launch OS protocol handlers with attacker arguments

Link for people: https://infrastack.ai/live/CVE-2026-124702 (this .md is for agents)

Telerik UI for WPF, a .NET component library, opens hyperlinks in documents without checking the URI scheme against an allowlist. A user who opens a crafted document or hyperlink can have the operating system launch an arbitrary protocol handler with attacker-controlled arguments.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find the Telerik UI for WPF package version in your .NET project files (for example `Telerik.Windows.Controls` in `.csproj` or `packages.config`)
- Check whether your application renders user-supplied documents or hyperlinks with Telerik controls

## Fix

- Telerik UI for WPF: move to `2026.4.1110` or later

## Timeline

- 2026-11-12T18:40:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124702

## From the sources

In Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_