Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering (CVE-2026-118036)
Description
October 2026 - CVE-2026-118036
- Progress® Telerik® RadPdfProcessing PDF import, rendering and image export, PdfStreamProcessing signing and incremental editing, and Telerik Document Processing Libraries AI document summarization and question answering (
Telerik.Windows.Documents.AIConnector,Telerik.Documents.AIConnector,Telerik.Documents.AI.RAG) of PDF, Word and Excel document text, versions>= 0and< 2026.3.1027.
What Are the Impacts
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or hang the host process via a crafted PDF document or document text submitted for summarization or question answering.
Issue
- CWE-674: Uncontrolled Recursion
- CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
- CWE-407: Inefficient Algorithmic Complexity
- CWE-770: Allocation of Resources Without Limits or Throttling
- CWE-789: Memory Allocation with Excessive Size Value
- CAPEC-230: Serialized Data with Nested Payloads
Solution
The issue is fixed in version 2026.3.1027. The Progress Telerik team strongly recommends upgrading to this version or later.
| Current Version | Update to |
|---|---|
>= 0 and < 2026.3.1027 | >= 2026.3.1027 |
All customers who have a license for Progress® Telerik® Document Processing Libraries can access their downloads here: Product Downloads | Your Account.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
External References
CVE-2026-118036 (High)
CVSS: 7.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or hang the host process via a crafted PDF document or document text submitted for summarization or question answering.