Multiple critical vulnerabilities disclosed in Progress Telerik before 2026.3.1027 including data confidentiality and remote DoS risks
Multiple security vulnerabilities have been identified in Progress Telerik versions prior to 2026.3.1027. These vulnerabilities include data confidentiality breaches, data integrity compromises, security policy bypass, and remote denial of service conditions. The vendor released security bulletins between October 27 and October 28, 2026, disclosing CVE-2026-118035 through CVE-2026-118039. Users are advised to consult the official Telerik security advisories and apply the necessary patches to mitigate these risks. The flaws impact several components related to document processing libraries, exposing them to resource consumption attacks and XML external entity reference issues.
Entenda a falha
A vulnerabilidade
Five CVEs affect the Progress Telerik Document Processing Libraries in versions before 2026.3.1027. CVE-2026-118039 is an XML external entity reference flaw and CVE-2026-118038 is a path traversal flaw; the articles do not say which libraries they sit in. CVE-2026-118035 (WordsProcessing), CVE-2026-118036 (PdfProcessing) and CVE-2026-118037 (SpreadProcessing) are uncontrolled resource consumption flaws. CERT-FR says the set allows remote denial of service, loss of data confidentiality and integrity, and security policy bypass. The articles give no severity scores and do not say what access or authentication an attacker needs. Version 2026.3.1027 is the fixed release.
Como funciona
The articles do not describe the internal flow in detail. The affected components are libraries that process Word, PDF and spreadsheet documents. For the resource consumption flaws, document input handled by these libraries can make them use excessive resources, leading to denial of service. For the XML external entity flaw, XML content in a document can make the parser reference external entities, which is how confidentiality is affected. For the path traversal flaw, file paths are handled in a way that can reach locations outside the intended ones.
Por que é vulnerável
The articles give no root-cause analysis. The CVE classes point to missing limits on resource use during document processing (CVE-2026-118035, -118036, -118037), unsafe handling of external entities in XML parsing (CVE-2026-118039) and insufficient validation of file paths (CVE-2026-118038). The articles do not describe what the fix changes beyond releasing version 2026.3.1027.
Onde está
No files or functions are named; the articles only point to the WordsProcessing, PdfProcessing and SpreadProcessing components of the Telerik Document Processing Libraries, and to the vendor's public knowledge-base bulletins for each CVE.
Como foi descoberta
The articles do not say who found the flaws or how. Telerik published security bulletins for them on 27 October 2026 (CVE-2026-118039 and CVE-2026-118038) and 28 October 2026 (CVE-2026-118037, -118035 and -118036). CERT-FR then published a consolidated advisory, CERTFR-2026-AVI-1533, on 13 November 2026, pointing to the vendor bulletins for the patches.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 12:17.
Linha do tempo
-
Multiple critical vulnerabilities disclosed in Progress Telerik before 2026.3.1027 including data confidentiality and remote DoS risks
ler a análise desta fonte ocultar
Multiple security vulnerabilities have been identified in Progress Telerik versions prior to 2026.3.1027. These vulnerabilities include data confidentiality breaches, data integrity compromises, security policy bypass, and remote denial of service conditions. The vendor released security bulletins between October 27 and October 28, 2026, disclosing CVE-2026-118035 through CVE-2026-118039. Users are advised to consult the official Telerik security advisories and apply the necessary patches to mitigate these risks. The flaws impact several components related to document processing libraries, exposing them to resource consumption attacks and XML external entity reference issues.