Cyber Centre lists flaws in several Progress Telerik products
Five CVEs cover race conditions, deserialization, configuration control, and code generation; exploitation is not stated.
42
CVE-2026-124699
Code injection in Telerik UI for WinForms before 2026.4.1111
- CVSS 3.1
- 7.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Telerik UI for WinForms before 2026.4.1111 improperly controls code generation. A local attacker who can get a user to process a crafted expression can run unauthorized code in the context of the affected application. Applications built with those library versions are affected.
What to do: Upgrade Telerik UI for WinForms to 2026.4.1111.
| Product | Affected | Fixed in |
|---|---|---|
| Progress Telerik UI for WinForms | versions prior to 2026.4.1111 | 2026.4.1111 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In Telerik UI for WinForms, versions prior to 2026.4.1111, an improper control of code generation vulnerability exists that allows an attacker to supply a crafted expression and execute unauthorized code in the context of the affected application.
- Weakness
- CWE-94
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H