CVE-2024-3892: Local code execution vulnerability in Telerik UI for WinForms

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-15 · updated 2026-06-17
Weakness: CWE-94

Description

A local code execution vulnerability is possible in Telerik UI for WinForms beginning in v2021.1.122 but prior to v2024.2.514. This vulnerability could allow an untrusted theme assembly to execute arbitrary code on the local Windows system.

Affected products

Progress Software Telerik UI for WinForms: from 2021.1.122 before 2024.2.514 — fixed in 2024.2.514

How to fix

Upgrade to a fixed version: Progress Software Telerik UI for WinForms 2024.2.514. Check the vendor advisory for mitigations.

References

https://docs.telerik.com/devtools/winforms/knowledge-base/local-code-execution-vulnerability-cve-2024-3892
https://docs.telerik.com/devtools/winforms/knowledge-base/local-code-execution-vulnerability-cve-2024-3892

Get alerted when CVE-2024-3892 or the next vulnerability affects your stack