CVE-2026-118037 in Telerik Document Processing Libraries
Summary
by MITRE • 10/28/2026
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular expression vulnerabilities in RadSpreadProcessing and RadSpreadStreamProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted XLSX or XLS workbook or formula.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in Progress Telerik Document Processing Libraries prior to version 2026.3.1027 represents a critical class of application-level denial-of-service issues stemming from inadequate input validation and resource management within the RadSpreadProcessing and RadSpreadStreamProcessing components. These libraries are widely used for parsing, creating, and manipulating spreadsheet files in various enterprise environments, making them a frequent target for attackers seeking to disrupt service availability or exhaust system resources. The core technical flaw lies in how these modules handle complex or malformed data structures embedded within XLSX and XLS workbook formats, specifically when processing formulas that trigger uncontrolled recursion, infinite loops, unchecked loop conditions, or inefficient regular expression evaluations.
From a technical perspective, the vulnerability exploits the lack of depth limits or iteration counters during the parsing of spreadsheet formulas. When an attacker crafts a malicious file containing nested functions or recursive references that exceed expected computational bounds, the library fails to detect this condition before execution begins. This leads to uncontrolled recursion where function calls stack indefinitely until the call stack is exhausted, resulting in a stack overflow exception and immediate process termination. Alternatively, certain malformed formulas can trigger infinite loops within the parsing engine if loop conditions are not properly validated against maximum iteration thresholds. In these scenarios, the application thread becomes permanently blocked, consuming CPU cycles at near 100% utilization without ever returning control to the operating system scheduler or completing the requested operation.
Furthermore, the inclusion of inefficient regular expression patterns in certain formula evaluations introduces a risk of ReDoS, or Regular Expression Denial of Service. If an attacker provides input that causes catastrophic backtracking within these regex engines, the processing time can increase exponentially relative to the length of the input string. This results in significant latency and resource exhaustion, effectively hanging the host process even if it does not crash immediately. The combination of uncontrolled recursion, infinite loops, and inefficient regular expressions creates a multifaceted attack surface where an unauthenticated attacker can reliably cause service disruption simply by uploading or submitting a specially crafted spreadsheet file through any interface that utilizes these vulnerable library versions for parsing.
The operational impact of this vulnerability is severe in terms of availability, which is one of the three pillars of the CIA triad. For applications relying on Telerik Document Processing Libraries to handle user-uploaded spreadsheets, such as financial reporting tools, data import utilities, or document management systems, a successful exploit can lead to complete service unavailability. In cloud-native environments utilizing container orchestration, repeated exploitation could trigger automatic restarts due to health check failures caused by the hung processes, leading to cascading resource consumption across the cluster and potentially affecting other tenants in shared infrastructure scenarios. The inability of an attacker to execute arbitrary code limits this primarily to a denial-of-service vector rather than full system compromise, but the business impact remains high due to downtime and potential data loss if unsaved operations are interrupted during process termination.
This vulnerability aligns with CWE-674, which describes Uncontrolled Recursion, as well as CWE-835, Loop with Unreachable Exit Condition Infinite Loop, highlighting fundamental flaws in control flow management within the library codebase. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior is consistent with T1496 Resource Hijacking, specifically subcomponent exhaustion or CPU consumption attacks designed to degrade service performance and availability for legitimate users. The attack vector typically falls under T1190 Exploit Public-Facing Application, as it targets a component that processes external input from potentially untrusted sources without sufficient sanitization or validation mechanisms in place prior to execution.
To mitigate this vulnerability, organizations must immediately upgrade the Progress Telerik Document Processing Libraries to version 2026.3.1027 or later, where these specific parsing logic flaws have been addressed with proper depth limiting and loop condition checks. In environments where immediate patching is not feasible due to dependency constraints, defensive measures should include implementing strict file size limits for uploaded spreadsheets and configuring application-level timeouts that forcibly terminate long-running processing threads before they can exhaust system resources. Additionally, deploying Web Application Firewalls or API gateways with deep packet inspection capabilities capable of detecting anomalous parsing patterns may provide a layer of defense against crafted inputs attempting to trigger these specific execution paths until the underlying software is updated.