CVE-2026-118035 in Document Processing Libraries
Summary
by MITRE • 10/28/2026
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in RadWordsProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted DOCX, DOC, RTF or HTML document.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in Progress Telerik Document Processing Libraries prior to version 2026.3.1027 represents a critical class of application-level denial-of-service issues stemming from inadequate input validation and resource management within the RadWordsProcessing component. This library is widely utilized for parsing, creating, and manipulating document formats such as DOCX, DOC, RTF, and HTML in enterprise environments where automated document processing pipelines are common. The core technical flaw lies in the parser's inability to properly handle malformed or specifically crafted input files that trigger uncontrolled recursion, inefficient algorithmic complexity, or infinite loops during the parsing phase. When an attacker submits a maliciously constructed file containing deeply nested structures or specific byte sequences designed to exploit these logic errors, the application enters a state of computational exhaustion rather than gracefully rejecting the invalid input.
From a technical perspective, the vulnerability manifests through three distinct mechanisms that collectively degrade system stability. First, uncontrolled recursion occurs when the parser encounters recursive data structures in the document format without sufficient depth limits or stack overflow protections. This leads to rapid consumption of memory and eventually causes a stack overflow exception, which typically terminates the host process abruptly. Second, inefficient algorithmic complexity allows an attacker to craft inputs that force the parsing engine into exponential time complexity scenarios, such as O(2^n) operations for relatively small increases in input size or structural depth. This results in severe CPU saturation, rendering the application unresponsive and consuming system resources intended for legitimate tasks. Third, infinite loops are triggered by specific edge cases in the document structure that prevent the parsing state machine from reaching a termination condition, causing the thread to hang indefinitely without releasing locks or memory allocations.
The operational impact of this vulnerability is significant, particularly in environments where documents are processed automatically via APIs or web services. An unauthenticated attacker can exploit these flaws remotely by simply uploading or submitting a crafted document through any interface that accepts file uploads for processing. The primary consequence is a denial-of-service condition affecting the host application and potentially the underlying server infrastructure. In cloud-native or containerized deployments, this may trigger automatic restarts of pods or instances due to health check failures caused by high CPU usage or out-of-memory errors. This not only disrupts business continuity but also creates opportunities for further exploitation if the system attempts to recover automatically without proper isolation mechanisms. Additionally, repeated attacks can lead to resource exhaustion at the infrastructure level, affecting other services running on the same host.
This vulnerability aligns with CWE-400 Uncontrolled Resource Consumption and CWE-674 Uncontrolled Recursion in the Common Weakness Enumeration taxonomy. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior corresponds to T1499 Endpoint Denial of Service, specifically under techniques that involve resource exhaustion through application layer attacks. The lack of authentication requirements makes it particularly dangerous as it expands the attack surface to include any external user or automated system interacting with the document processing endpoint.
Mitigation strategies must focus on immediate patching and defensive configuration changes. Organizations should upgrade the Progress Telerik Document Processing Libraries to version 2026.3.1027 or later, where these parsing logic errors have been corrected by implementing proper recursion depth limits, optimizing algorithmic complexity for edge cases, and adding loop termination conditions. In addition to patching, it is advisable to implement input validation layers at the network perimeter using Web Application Firewalls that can detect anomalous file sizes or structures indicative of such attacks. Deploying rate limiting on document upload endpoints can also mitigate the impact by preventing rapid successive requests from exhausting system resources before legitimate users are affected. Furthermore, running document processing services in isolated containers with strict resource quotas ensures that even if an attack succeeds, its blast radius is contained and does not compromise the entire host infrastructure.