CVE-2026-124704: Deserialization of Untrusted Data in Progress Telerik UI for WPF
In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Telerik UI for WPFto a version that resolves this vulnerability.Fixed in 2026.4.1110
Event History
Frequently Asked Questions
What conditions are required for exploitation?
Exploitation requires local access and user interaction. The attacker does not need privileges, but must induce a user to interact with untrusted serialized data in the affected application.
Which deployments should be treated as affected?
Any application using Telerik UI for WPF earlier than version 2026.4.1110 should be treated as affected based on the available information. The data does not identify specific controls, configurations, or deployment scenarios that are excluded.
What is the immediate remediation?
Upgrade Telerik UI for WPF to version 2026.4.1110 or later. If an immediate upgrade is not possible, the provided information does not specify a supported workaround; reduce exposure to untrusted serialized data and user interaction where feasible.