CVE-2026-118037: Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular expression vulnerabilities in RadSpreadProcessing and RadSpreadStreamProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted XLSX or XLS workbook or formula.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Telerik Document Processing Librariesto a version that resolves this vulnerability.Fixed in 2026.3.1027
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Applications using Telerik Document Processing Libraries' RadSpreadProcessing or RadSpreadStreamProcessing versions earlier than 2026.3.1027 are affected when they process XLSX or XLS workbooks or formulas that an attacker can craft.
Does exploitation require authentication or user interaction?
No. The vulnerability is rated with no privileges required and no user interaction required; an unauthenticated attacker can trigger it using a crafted workbook or formula.
What is the expected impact of successful exploitation?
Successful exploitation can terminate or hang the host process, causing a denial of service. The provided severity vector indicates availability impact without confidentiality or integrity impact.
What version resolves the issue?
Update Telerik Document Processing Libraries to version 2026.3.1027 or later.