Improper Control of Generation of Code Vulnerability (CVE-2026-124703)
Description
November 2026 - CVE-2026-124703
- Telerik UI for WPF 2026 Q3 (2026.3.1007) or earlier.
What Are the Impacts
In Telerik UI for WPF, versions prior to 2026.4.1110, an improper control of code generation vulnerability exists that allows an attacker to execute unauthorized code in the context of the affected application.
Issue
- CWE-94: Improper Control of Generation of Code
- CAPEC-242: Code Injection
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
>= 0 && <= 2026.3.1007 | >= 2026.4.1110 |
To upgrade using the Telerik UI for WPF Visual Studio extension, follow the update instructions. Customers with a Telerik UI for WPF license can access their downloads on the Product Downloads | Your Account page.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
External References
CVE-2026-124703 (High)
CVSS: 7.8
In Telerik UI for WPF, versions prior to 2026.4.1110, an improper control of code generation vulnerability exists that allows an attacker to execute unauthorized code in the context of the affected application.