# Unsafe Deserialization Vulnerability

## Description

Product Alert – September 2024 - [CVE-2024-7576](https://www.cve.org/CVERecord?id=CVE-2024-7576)

* Telerik UI for WPF 2024 Q3 (2024.3.821) or earlier.

## Issue

CWE-502: Deserialization of Untrusted Data

### What Are the Impacts

In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.

## Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

| Current Version                 | Guidance                                                                                                                                                                   |
| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 2024 Q3 (2024.3.806) or earlier | Update to 2024 Q3 (2024.3.924) ([installation instructions](https://www.telerik.com/products/wpf/documentation/installation/manual-setup-guides/nuget/nuget-installation)) |

All customers who have a Telerik UI for WPF license can access the downloads here [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download?product=RCWPF).

## Notes

* If a project is not using the RichTextBox, the application is not affected by this vulnerability. However, we recommend customers also review [CVE-2024-8316](https://docs.telerik.com/devtools/wpf/knowledge-base/insecure-deserialization-cve-2024-8316), a similar issue.
* To check your version of Telerik UI for WPF
  * Via source code: Inspect the Version property of any of the `Telerik.Windows.*` assembly references in the project.
  * Via deployed application: Locate any `Telerik.Windows.*.dll` file in the application's directory, right-click, select Properties and view the Version in the Details tab.
* If you have any questions or concerns related to this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to Telerik customers with an active support plan.

## External References

[CVE-2024-7576](https://www.cve.org/CVERecord?id=CVE-2024-7576) (HIGH)

**CVSS:** 7.8

In Progress® Telerik® UI for WPF versions prior to 2024 Q2 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.