Release History

Progress® Telerik® Document Processing 2026.3.1027

October 27, 2026

DocumentProcessing

Dependencies

• Telerik Licensing minimal required version is updated to 1.11.0.

PdfProcessing

NEW

• PDF import now supports configurable limits for decoded data, CCITT image pixels, recursive and tree depth, optional-content expansion, and structure-element expansion. Import rejects detected cycles in linked PDF objects with catchable exceptions. Configure PdfImportSettings before import; each import snapshots its depth limits.
• Added PdfImportSettings.InvalidStructureTreeHandling to choose whether import continues or throws when invalid structure-tree data is detected. Default behavior continues import, skipping invalid entries without repairing them.
• Introduced support for Linked Timestamp Correctness.
• Support for Locking Form Fields and Preserving Existing Locks After Signing.
• Type3 glyph cycles are rejected, while distinct fonts can share a CharProcs stream with different resources. Marked-content and clipping imports honor the existing MaxNestingDepth; model and rendering traversals enforce a fixed nesting limit.
• Composite-glyph and Type1/CFF component cycles, excessive charstring subroutine depth, and expanded-outline limits now produce catchable errors instead of unbounded processing.
• Adds PdfImportSettings.MaxJbig2ImagePixelCount (default 640,000,000), independent of MaxImagePixelCount. Increase it for larger JBIG2 images; increase MaxDecodedStreamSize if valid files need more auxiliary storage.
• Handled duplicate annotation references across pages during import.
• Signature validation now verifies the CMS signature for adbe.pkcs7.sha1, checks the certificate identified by the CMS signer, and rejects legacy signatures whose byte ranges do not match the signed content and /Contents value.
• Export escapes final encoded bytes. Non-ASCII text requested as ASCII uses UTF-16BE instead of losing characters through byte truncation.
• Built-in handlers now populate SignerInformation from the signing certificate’s subject instead of the PDF-controlled Name value.
• SignatureValidationResult.CoversWholeDocument reports whether a signature covers the current PDF source, excluding its matching /Contents value. Use it alongside signature-integrity and certificate-validation results; it does not assess DocMDP/FieldMDP permissions.
• CMap processing handles valid record counts above 65,535 without counter wraparound.
• PdfExportSettings.EncryptionType now defaults to AES-256 (revision 6); encryption remains opt-in. Explicit RC4 and AES-128 selections remain available. Invalid legacy key lengths now fail before key derivation.
• Font, TTC, and CFF ranges are checked before reads and allocations. Malformed data is rejected; repeated TTC offsets reuse loaded fonts.
• SkiaImageFormatProvider: Render Indexed CCITT backgrounds in black.

FIXED

• Remediated security vulnerability CVE-2026-118039.
• Remediated security vulnerability CVE-2026-118042.
• Concurrent PDF export in fresh process may hang, throw exceptions, or produce incorrect font embedding.
• Excessive text wrapping and row heights due to columns collapsing to excessively narrow widths when total column width exceeds table width.
• Incorrect CID font resolution corrupts text after import-export.
• An invalid structure tree triggers a NullReferenceException instead of an InvalidStructureTreeException.

SpreadProcessing

NEW

• Expose API for PDF pages limits when exporting a Workbook.
• Introduce API for maximum data table export size budget.

FIXED

• Remediated security vulnerability CVE-2026-118038.
• ArgumentException thrown when importing files with format string US$#,##0.0m;($#,##0.0).

WordsProcessing

FIXED

• Remediated security vulnerability CVE-2026-118040.
• Remediated security vulnerability CVE-2026-118041.
• HtmlFormatProvider: ArgumentNullException when importing a document with
  elements inside a list.
• PdfFormatProvider: Unexpected table content indentation during PDF export when cells lack explicit margins and do not inherit table-level margins.
• RtfFormatProvider: Merged cells with preferred widths narrower than their full column spans lose their spans on export.
• Bolder font weight is not imported as bold from HTML.
• Empty list items are not imported from HTML.