CVE-2026-118040 in Telerik Document Processing Libraries
Summary
by MITRE • 10/28/2026
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticated attacker to cause signature validation to report forged content as unmodified and its signing certificate as valid via a crafted signed PDF document.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in Progress Telerik Document Processing Libraries prior to version 2026.3.1027 represents a critical failure in the cryptographic verification mechanisms embedded within the RadPdfProcessing component. This flaw specifically affects the digital signature validation process, which is designed to ensure that PDF documents have not been altered since they were signed and that the signer's identity is authentic. The core technical issue stems from improper verification of cryptographic signatures combined with inadequate certificate validation logic. When a user or application processes a digitally signed PDF using this library, the software fails to rigorously check the integrity of the signature against the document content and does not properly validate the chain of trust associated with the signing certificate. This allows an attacker who crafts a maliciously constructed PDF file to bypass these security checks entirely.
From a technical perspective, the flaw enables an unauthenticated actor to present a forged or tampered document that appears legitimate to any system relying on this library for validation. By manipulating the internal structure of the signed PDF and exploiting weaknesses in how the certificate chain is evaluated, the attacker can cause the validation routine to incorrectly report that the content remains unmodified despite actual alterations being present. Furthermore, the system erroneously accepts a signing certificate as valid even when it may be expired, revoked, or issued by an unauthorized certification authority. This breakdown in verification logic undermines the fundamental security guarantees provided by digital signatures, which are intended to provide integrity and non-repudiation for electronic documents.
The operational impact of this vulnerability is severe, particularly in environments where automated document processing workflows rely on these libraries to verify incoming files before execution or storage. If an organization integrates this vulnerable library into their application stack without proper mitigation, they risk accepting maliciously crafted PDFs as authentic. This could lead to the execution of unauthorized actions based on tampered instructions contained within the document, such as financial transactions in banking applications or changes to configuration settings in enterprise software. In supply chain scenarios where documents are processed automatically, this flaw allows an attacker to inject false data into downstream systems without detection, potentially leading to significant data integrity issues and compliance violations.
This vulnerability aligns with CWE-347 Improper Verification of Cryptographic Signature and CWE-295 Improper Certificate Validation as defined by the Common Weakness Enumeration standard. The attack vector is classified under MITRE ATT&CK technique T1608 Supply Chain Compromise, specifically through software dependency exploitation, where an attacker leverages a trusted component to bypass security controls. To mitigate this risk, organizations must immediately upgrade the Progress Telerik Document Processing Libraries to version 2026.3.1027 or later, which addresses these validation flaws. Additionally, developers should implement defense-in-depth strategies by validating digital signatures using independent cryptographic libraries that adhere strictly to PDF specification standards and certificate authority policies. Regular security audits of third-party dependencies and the implementation of strict input validation protocols are essential to prevent similar exploitation in future versions.