Deserialization of Untrusted Data Vulnerability (CVE-2026-124704)
Description
November 2026 - CVE-2026-124704
- Telerik UI for WPF 2026 Q3 (2026.3.1007) or earlier.
What Are the Impacts
In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.
Issue
- CWE-502: Deserialization of Untrusted Data
- CAPEC-586: Object Injection
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
>= 0 && <= 2026.3.1007 | >= 2026.4.1110 |
To upgrade using the Telerik UI for WPF Visual Studio extension, follow the update instructions. Customers with a Telerik UI for WPF license can access their downloads on the Product Downloads | Your Account page.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
External References
CVE-2026-124704 (High)
CVSS: 7.8
In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.