Telerik Document Processing before 2026.3.1027 can exhaust resources (CVE-2026-118035)
Canada's Cyber Centre points administrators to Progress's advisory for RadWordsProcessing and says to apply updates when available.
40
Vulnerability1 · 1 read
CVE-2026-118035
DoS in Telerik RadWordsProcessing before 2026.3.1027
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Uncontrolled recursion, inefficient algorithms, and infinite loops in Progress Telerik Document Processing Libraries' RadWordsProcessing let an unauthenticated remote attacker terminate or hang the host process by supplying a crafted DOCX, DOC, RTF, or HTML document. No privileges or user interaction are required. Applications that parse those formats with a vulnerable library are affected.
What to do: Upgrade Progress Telerik Document Processing Libraries to 2026.3.1027 or later.
| Product | Affected | Fixed in |
|---|---|---|
| Progress Telerik Document Processing Libraries (RadWordsProcessing) | prior to 2026.3.1027 | 2026.3.1027 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in RadWordsProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted DOCX, DOC, RTF or HTML document.
- Weakness
- CWE-407, CWE-674, CWE-835
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H