CVE-2026-124700: URL Redirection to Untrusted Site in Progress Telerik UI for WinForms
In Telerik UI for WinForms, versions prior to 2026.4.1111, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Telerik UI for WinFormsto a version that resolves this vulnerability.Fixed in 2026.4.1111
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to provide a crafted document or hyperlink using a URI scheme that is not allowlisted and persuade a user to open it. No prior privileges are required, but user interaction is required.
Who is exposed?
Users of Telerik UI for WinForms versions earlier than 2026.4.1111 are exposed when they open crafted documents or hyperlinks. Exploitation is local in the sense that the affected user must open the attacker-controlled content.
What is the impact of successful exploitation?
Successful exploitation can launch arbitrary operating system protocol handlers with attacker-controlled arguments. The vulnerability is rated high with impacts to confidentiality, integrity, and availability.
How can I determine whether my environment is affected?
Check the installed Telerik UI for WinForms version. Versions prior to 2026.4.1111 are affected.