Improper Control of Generation of Code Vulnerability (CVE-2026-124699)
Description
November 2026 - CVE-2026-124699
- Telerik UI for WinForms 2026 Q3 2026.3.1007 or earlier.
What Are the Impacts
In Telerik UI for WinForms, versions prior to 2026.4.1111, an improper control of code generation vulnerability exists that allows an attacker to supply a crafted expression and execute unauthorized code in the context of the affected application.
Issue
- CWE-94: Improper Control of Generation of Code
- CAPEC-242: Code Injection
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
>= 0 && <= 2026.3.1007 | >= 2026.4.1111 |
Follow the update instructions for precise instructions. All customers who have a license for Telerik UI for WinForms can access their downloads here Product Downloads | Your Account.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
External References
CVE-2026-124699 (High)
CVSS: 7.8
In Telerik UI for WinForms, versions prior to 2026.4.1111, an improper control of code generation vulnerability exists that allows an attacker to supply a crafted expression and execute unauthorized code in the context of the affected application.