Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing (CVE-2026-118040)
Description
October 2026 - CVE-2026-118040
- Progress® Telerik® RadPdfProcessing digital signature validation, versions
>= 0and< 2026.3.1027.
What Are the Impacts
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticated attacker to cause signature validation to report forged content as unmodified and its signing certificate as valid via a crafted signed PDF document.
Issue
- CWE-347: Improper Verification of Cryptographic Signature
- CWE-295: Improper Certificate Validation
- CAPEC-475: Signature Spoofing by Improper Validation
Solution
The issue is fixed in version 2026.3.1027. The Progress Telerik team strongly recommends upgrading to this version or later.
| Current Version | Update to |
|---|---|
>= 0 and < 2026.3.1027 | >= 2026.3.1027 |
All customers who have a license for Progress® Telerik® Document Processing Libraries can access their downloads here: Product Downloads | Your Account.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
External References
CVE-2026-118040 (High)
CVSS: 7.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticated attacker to cause signature validation to report forged content as unmodified and its signing certificate as valid via a crafted signed PDF document.