New to Telerik Document Processing? Start a free 30-day trial

Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing (CVE-2026-118037)

Updated on Oct 28, 2026

Description

October 2026 - CVE-2026-118037

Progress® Telerik® RadSpreadProcessing XLSX and XLS import, formula calculation and JSON export, and RadSpreadStreamProcessing XLSX import, versions >= 0 and < 2026.3.1027.

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular expression vulnerabilities in RadSpreadProcessing and RadSpreadStreamProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted XLSX or XLS workbook or formula.

Issue

CWE-674: Uncontrolled Recursion
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-606: Unchecked Input for Loop Condition
CWE-1333: Inefficient Regular Expression Complexity
CAPEC-230: Serialized Data with Nested Payloads

Solution

The issue is fixed in version 2026.3.1027. The Progress Telerik team strongly recommends upgrading to this version or later.

Current Version	Update to
`>= 0` and `< 2026.3.1027`	`>= 2026.3.1027`

All customers who have a license for Progress® Telerik® Document Processing Libraries can access their downloads here: Product Downloads | Your Account.

Notes

If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.

External References

CVE-2026-118037 (High)

CVSS: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H