CVE-2026-118035: Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-28 · updated 2026-10-28
Weakness: CWE-407

Description

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in RadWordsProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted DOCX, DOC, RTF or HTML document.

Affected products

Progress Software Telerik Document Processing Libraries: before 2026.3.1027 — fixed in 2026.3.1027

How to fix

Upgrade to a fixed version: Progress Software Telerik Document Processing Libraries 2026.3.1027. Check the vendor advisory for mitigations.

References

https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-uncontrolled-resource-consumption-wordsprocessing-cve-2026-118035

Get alerted when CVE-2026-118035 or the next vulnerability affects your stack