CVE-2026-124705 · Package
NO FIX YET · SEE WHAT TO DO
Telerik UI for .NET MAUI before 16.0.0 does not restrict URI schemes in RadRichTextEditor hyperlinks and RadPdfViewer link annotations. A user who opens a crafted document or PDF link can make the operating system launch an arbitrary protocol handler with attacker-controlled arguments.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Apps built with Telerik UI for .NET MAUI that display user-supplied documents or PDFs using RadRichTextEditor or RadPdfViewer are exposed. The attack needs a user to open a crafted link inside the document, so apps that only show trusted content are lower risk. Teams not using these controls can skip it.
Not affected if no-telerik-maui, no-user-documents
Who cares android, dotnet, ios, maui, telerik, windows
Telerik.UI.for.Maui in the .csproj or packages.lock.json) and read its version.16.0.0 or later.In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.