CVE-2026-124701: Deserialization of Untrusted Data in Progress Telerik UI for WinForms
Published Nov 12, 2026
·Updated
In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.
Event History
Nov 12, 2026
CVE Published
via MITRE·10:45 AM
Data Sourced
via MITRE·10:45 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Telerik UI for WinForms versions prior to 2026.4.1111 are affected. The issue can enable unauthorized actions in the context of an affected application.
2
What access does an attacker need to exploit this issue?
The severity vector indicates local attack access, no privileges required, and user interaction required. The provided information does not specify the exact user action or the untrusted data input path involved.