CVE-2026-106164 in Telerik Document Processing Libraries
Summary
by MITRE • 10/07/2026
In Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists when importing an XLS file with a specifically-targted corruption, the import timeout is ignored resulting in an unresponsive CPU thread and denial of service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The Progress Telerik Document Processing SpreadProcessing library contains a critical logic flaw within its Excel (XLS) parsing engine that leads to resource exhaustion under specific conditions. This vulnerability affects versions prior to 2026.3.1006 and is classified as an infinite loop condition triggered by malformed input data. When the application attempts to import or parse an XLS file containing a specifically crafted corruption pattern, the internal state machine responsible for reading cell values or formatting information fails to terminate its iteration cycle correctly. Instead of detecting the invalid structure and throwing an exception or returning an error code as expected, the parser enters a continuous execution loop that consumes available processing cycles indefinitely.
From a technical perspective, this flaw represents a failure in input validation and boundary checking during the parsing phase of file handling operations. The vulnerability allows an attacker to craft a malicious XLS file where specific byte sequences cause the pointer or index within the internal data structures to reset or remain static while the loop condition remains true. This results in a denial of service scenario characterized by unresponsive CPU threads. Because the import timeout mechanism is ignored, standard defensive timeouts do not mitigate the impact, allowing the thread to run until system resources are exhausted or the process is manually terminated. This behavior aligns with CWE-835, which describes loops that never terminate due to logic errors in loop control variables, and falls under the broader category of CWE-400 regarding uncontrolled resource consumption.
The operational impact of this vulnerability is significant for any application relying on SpreadProcessing to handle user-uploaded or external Excel files. A successful exploitation leads to a complete denial of service against the hosting process. In web applications or services, this can cause thread pool exhaustion, leading to broader system instability and inability to serve legitimate requests. The attack vector typically involves an attacker providing a maliciously constructed XLS file through any interface that accepts document uploads for processing, such as email attachments, data import portals, or automated reporting systems. This aligns with MITRE ATT&CK technique T1496, Resource Hijacking, specifically the sub-technique of CPU consumption to disrupt service availability.
Mitigation strategies must prioritize immediate software updates and robust input sanitization practices. The most effective remediation is upgrading the Progress Telerik Document Processing SpreadProcessing library to version 2026.3.1006 or later, where this logic error has been resolved by developers implementing proper loop termination conditions and enhanced validation for corrupted file structures. For environments where immediate patching is not feasible, organizations should implement strict input filtering at the network perimeter or application gateway level to reject files that exhibit characteristics of known malformed XLS patterns before they reach the processing engine. Additionally, deploying runtime protection mechanisms such as process isolation with resource limits can help contain the impact by preventing a single thread from monopolizing CPU resources indefinitely. Security teams should also monitor for unusual spikes in CPU usage associated with document parsing services to detect potential exploitation attempts in real-time.