CVE-2026-106140: Deserialization of Untrusted Data in Telerik Reporting Report Designers
In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Telerik Reportingto a version that resolves this vulnerability.Fixed in 20.3.26.1110
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users of the .NET Framework Telerik Reporting report designers are exposed if they use a version earlier than 20.3.26.1110 and perform the affected editing operations. Exploitation also requires a local attacker with low privileges.
What access and user interaction does an attacker need?
The attacker needs local access with low privileges. A user must perform certain editing operations for arbitrary code execution to occur in the designer process.
What is the impact if exploitation succeeds?
An attacker can execute arbitrary code in the context of the report designer process. The vulnerability affects confidentiality, integrity, and availability at high impact levels.