CVE-2026-124699: Improper Control of Generation of Code in Progress Telerik UI for WinForms
In Telerik UI for WinForms, versions prior to 2026.4.1111, an improper control of code generation vulnerability exists that allows an attacker to supply a crafted expression and execute unauthorized code in the context of the affected application.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Telerik UI for WinFormsto a version that resolves this vulnerability.Fixed in 2026.4.1111
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must be able to supply a crafted expression to the affected application. Successful exploitation also requires user interaction, and the code executes in the context of that application.
Which installations are affected?
Telerik UI for WinForms versions earlier than 2026.4.1111 are affected. The provided information does not state whether any particular default configuration exposes expression input.
What is the impact of successful exploitation?
A successful attacker can execute unauthorized code in the affected application's context. The vulnerability is rated high severity with impacts to confidentiality, integrity, and availability.