{"id":"CVE-2026-124705","kind":"vulnerability","aliases":["CVE-2026-124705"],"related":[],"title":"Telerik UI for .NET MAUI: crafted links launch OS protocol handlers","description":"In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens.","summary":"Telerik UI for .NET MAUI before 16.0.0 does not restrict URI schemes in RadRichTextEditor hyperlinks and RadPdfViewer link annotations. A user who opens a crafted document or PDF link can make the operating system launch an arbitrary protocol handler with attacker-controlled arguments.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","dotnet","ios","maui","package","telerik","windows"],"not_affected_if":["no-telerik-maui","no-user-documents"],"how_to_check":"- Look for the Telerik UI for .NET MAUI package in the project file (`Telerik.UI.for.Maui` in the `.csproj` or `packages.lock.json`) and read its version.\n- Check whether the app uses RadRichTextEditor or RadPdfViewer to open user-supplied documents or PDFs.","fix":"- Telerik UI for .NET MAUI: move to `16.0.0` or later.","status":"open","published_at":"2026-11-12T12:18:22+00:00","first_seen_at":"2026-11-12T12:38:18+00:00","triaged_at":"2026-11-12T12:40:33+00:00","updated_at":"2026-11-12T12:40:33+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T12:40:33Z","model":"claude-haiku-5-5","output":{"fix":"- Telerik UI for .NET MAUI: move to `16.0.0` or later.","reach":"local","title":"Telerik UI for .NET MAUI: crafted links launch OS protocol handlers","impact":"high","summary":"Telerik UI for .NET MAUI before 16.0.0 does not restrict URI schemes in RadRichTextEditor hyperlinks and RadPdfViewer link annotations. A user who opens a crafted document or PDF link can make the operating system launch an arbitrary protocol handler with attacker-controlled arguments.","audience":"developers","category":"package","nicknames":[],"who_cares":["dotnet","maui","telerik","windows","android","ios"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker launches OS protocol handlers with chosen arguments on user machines","analyst_note":"","how_to_check":"- Look for the Telerik UI for .NET MAUI package in the project file (`Telerik.UI.for.Maui` in the `.csproj` or `packages.lock.json`) and read its version.\n- Check whether the app uses RadRichTextEditor or RadPdfViewer to open user-supplied documents or PDFs.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-telerik-maui","no-user-documents"],"who_is_affected":"Apps built with Telerik UI for .NET MAUI that display user-supplied documents or PDFs using RadRichTextEditor or RadPdfViewer are exposed. The attack needs a user to open a crafted link inside the document, so apps that only show trusted content are lower risk. Teams not using these controls can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00077,"input_tokens":4615,"output_tokens":617,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124705':14A,17A '-2026':13A,16A '16.0.0':31B,79C 'allow':96C 'allowlist':123C 'android':18B 'annot':43B,94C 'arbitrari':61B,102C 'argument':68B,111C 'attack':66B,99C,109C 'attacker-control':65B,108C 'control':67B,110C 'craft':6A,49B,114C 'cve':12A,15A 'document':50B,115C 'dotnet':19B 'handl':89C,95C 'handler':11A,63B,106C 'hyperlink':39B,88C 'io':20B 'launch':8A,59B,101C 'link':7A,42B,53B,93C,118C 'make':55B 'maui':5A,21B,29B,75C 'net':4A,28B,74C 'non':122C 'non-allowlist':121C 'open':47B,129C 'oper':57B,103C 'os':9A 'packag':22B 'pdf':52B,117C 'prior':76C 'progress':70C 'protocol':10A,62B,105C 'radpdfview':41B,92C 'radrichtexteditor':38B,87C 'redirect':83C 'restrict':34B 'scheme':36B,125C 'system':58B,104C 'telerik':1A,23B,25B,71C 'ui':2A,26B,72C 'unauthent':98C 'untrust':81C 'uri':35B,124C 'url':82C 'user':45B,128C 'version':78C 'via':112C 'vulner':84C 'window':24B","nicknames":[],"mitigations":[],"who_affected":"Apps built with Telerik UI for .NET MAUI that display user-supplied documents or PDFs using RadRichTextEditor or RadPdfViewer are exposed. The attack needs a user to open a crafted link inside the document, so apps that only show trusted content are lower risk. Teams not using these controls can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","dotnet","high","ios","maui","package","telerik","windows"],"campaign_type":null,"search_a":"'-124705':14A,17A '-2026':13A,16A 'craft':6A 'cve':12A,15A 'handler':11A 'launch':8A 'link':7A 'maui':5A 'net':4A 'os':9A 'protocol':10A 'telerik':1A 'ui':2A","search_b":"'16.0.0':31B 'android':18B 'annot':43B 'arbitrari':61B 'argument':68B 'attack':66B 'attacker-control':65B 'control':67B 'craft':49B 'document':50B 'dotnet':19B 'handler':63B 'hyperlink':39B 'io':20B 'launch':59B 'link':42B,53B 'make':55B 'maui':21B,29B 'net':28B 'open':47B 'oper':57B 'packag':22B 'pdf':52B 'protocol':62B 'radpdfview':41B 'radrichtexteditor':38B 'restrict':34B 'scheme':36B 'system':58B 'telerik':23B,25B 'ui':26B 'uri':35B 'user':45B 'window':24B","search_c":"'16.0.0':79C 'allow':96C 'allowlist':123C 'annot':94C 'arbitrari':102C 'argument':111C 'attack':99C,109C 'attacker-control':108C 'control':110C 'craft':114C 'document':115C 'handl':89C,95C 'handler':106C 'hyperlink':88C 'launch':101C 'link':93C,118C 'maui':75C 'net':74C 'non':122C 'non-allowlist':121C 'open':129C 'oper':103C 'pdf':117C 'prior':76C 'progress':70C 'protocol':105C 'radpdfview':92C 'radrichtexteditor':87C 'redirect':83C 'scheme':125C 'system':104C 'telerik':71C 'ui':72C 'unauthent':98C 'untrust':81C 'uri':124C 'url':82C 'user':128C 'version':78C 'via':112C 'vulner':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T12:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124705","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124705","severity":null,"published_at":"2026-11-12T12:18:22+00:00","modified_at":"2026-11-12T12:18:22+00:00","first_seen_at":"2026-11-12T12:38:18+00:00","fetched_at":"2026-11-12T12:38:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}