# Deserialization of Untrusted Data Vulnerability (CVE-2026-124704)

## Description

November 2026 - [CVE-2026-124704](https://www.cve.org/CVERecord?id=CVE-2026-124704)

* Telerik UI for WPF 2026 Q3 (2026.3.1007) or earlier.

### What Are the Impacts

In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.

## Issue

* CWE-502: Deserialization of Untrusted Data
* CAPEC-586: Object Injection

## Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

| Current Version            | Update to        |
| -------------------------- | ---------------- |
| `>= 0` && `<= 2026.3.1007` | `>= 2026.4.1110` |

To upgrade using the Telerik UI for WPF Visual Studio extension, follow the [update instructions](https://www.telerik.com/products/wpf/documentation/installation/manual-setup-guides/visual-studio-extensions/extensions-upgrading). Customers with a Telerik UI for WPF license can access their downloads on the [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download) page.

## Notes

* If you have any questions or concerns related to this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to customers with an active support plan.

## External References

[CVE-2026-124704](https://www.cve.org/CVERecord?id=CVE-2026-124704) (High)

**CVSS:** 7.8

In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.