Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing (CVE-2026-118035)
Description
October 2026 - CVE-2026-118035
- Progress® Telerik® RadWordsProcessing DOCX, DOC, RTF and HTML import, PDF and TXT export, and field evaluation (
UpdateFields,MailMerge), versions>= 0and< 2026.3.1027.
What Are the Impacts
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in RadWordsProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted DOCX, DOC, RTF or HTML document.
Issue
- CWE-674: Uncontrolled Recursion
- CWE-407: Inefficient Algorithmic Complexity
- CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
- CAPEC-230: Serialized Data with Nested Payloads
Solution
The issue is fixed in version 2026.3.1027. The Progress Telerik team strongly recommends upgrading to this version or later.
| Current Version | Update to |
|---|---|
>= 0 and < 2026.3.1027 | >= 2026.3.1027 |
All customers who have a license for Progress® Telerik® Document Processing Libraries can access their downloads here: Product Downloads | Your Account.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
External References
CVE-2026-118035 (High)
CVSS: 7.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in RadWordsProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted DOCX, DOC, RTF or HTML document.