CVE-2026-118037
High · 7.5CVSS
7.5
EPSS
0.3%
Published
Oct 28, 2026
CISA due date
—
The record
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular expression vulnerabilities in RadSpreadProcessing and RadSpreadStreamProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted XLSX or XLS workbook or formula.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-93653 A denial of service flaw was found in Poppler's Splash backend. CWE-606
- CVE-2026-85730 smol-toml is a small, fast, and correct TOML parser and serializer. CWE-606
- CVE-2026-13761 Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of… CWE-606
- CVE-2026-16599 GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication… CWE-606
- CVE-2026-62901 Unchecked input for loop condition in .NET allows an unauthorized attacker to deny… CWE-606
- CVE-2026-71439 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify… CWE-606
- CVE-2026-68077 An authenticated attacker can craft a disposition frame with large or illegal ranges… CWE-606
- CVE-2026-67554 An authenticated attacker can craft a disposition frame with large or illegal ranges… CWE-606