CVE-2026-124704 · Package
NO FIX YET · SEE WHAT TO DO
Telerik UI for WPF, a component library for Windows desktop apps, deserializes untrusted data without checks. An attacker can perform unauthorized actions inside the affected application.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Apps built with Telerik UI for WPF older than 2026.4.1110 are exposed, and the flaw is reached through data the app deserializes. The sources do not say which input paths are exposed or whether a default configuration is affected. Teams that do not use Telerik UI for WPF can skip it.
Not affected if not-using-telerik-wpf
Who cares dotnet, telerik, windows, wpf
Telerik.UI.for.Wpf package in the .csproj or packages.config.2026.4.1110.2026.4.1110 or later.In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.