New to Telerik Reporting? Start a free 30-day trial

Deserialization of Untrusted Data in Telerik Reporting Report Designers (CVE-2026-106140)

Updated on Nov 11, 2026

Description

October 2026 - CVE-2026-106140

Progress® Telerik® Reporting .NET Framework report designers (Standalone Report Designer and Visual Studio Report Designer), versions >= 0 and < 20.3.26.1110.
The .NET 8+ report designer is not affected.

In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations.

Issue

CWE-502: Deserialization of Untrusted Data
CAPEC-586: Object Injection

Solution

The issue is fixed in version 20.3.26.1110. The Progress Telerik team strongly recommends upgrading to this version or later.

Current Version	Update to
`>= 0` and `< 20.3.26.1110`	`>= 20.3.26.1110`

Behavior changes:

Report items copied with an earlier version of the designer cannot be pasted into the updated designer.
Visual Studio-specific content, such as project types and event handlers, is not carried over when you copy and paste between separate Visual Studio instances.

Follow the update instructions for precise instructions. All customers who have a license for Progress® Telerik® Reporting can access their downloads here: Product Downloads | Your Account.

Notes

If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.

External References

CVE-2026-106140 (High)

CVSS: 7.3

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local user with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations.