CVE-2026-124702 in Telerik UI for WPF
Summary
by MITRE • 11/12/2026
In Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/12/2026
The identified security flaw resides within Telerik UI for WPF components prior to version 2026.4.1110, specifically affecting how the application processes hyperlink navigation requests originating from untrusted sources such as external documents or web content embedded within the interface. This vulnerability is classified under CWE-798: Use of Hard-coded Credentials in conjunction with improper validation of input data, but more accurately aligns with CWE-601: URL Redirection to Untrusted Site (Open Redirect) and CWE-434: Unrestricted Upload of File with Dangerous Type when considering the payload delivery mechanism. The core technical deficiency lies in the insufficient sanitization and validation logic applied to URI schemes before they are passed to the underlying operating system's protocol handler registry. When a user interacts with a crafted hyperlink or document containing a non-standard, unallowlisted Uniform Resource Identifier scheme, the application fails to restrict execution to safe protocols such as HTTP or HTTPS, thereby permitting arbitrary command invocation at the OS level.
From an operational perspective, this vulnerability enables a remote code execution scenario that relies heavily on social engineering and user interaction. An attacker can distribute malicious documents or host web pages containing hyperlinks with custom URI schemes designed to trigger specific system applications or services installed on the victim's machine. Upon clicking the link, the WPF application delegates the navigation request directly to Windows without verifying whether the target protocol is safe for automated execution. This allows an adversary to launch arbitrary operating system protocol handlers with attacker-controlled arguments, potentially leading to privilege escalation, data exfiltration, or complete system compromise depending on the capabilities of the targeted handler and the permissions under which the application is running. The attack vector is categorized as Remote (Network) in MITRE ATT&CK framework techniques related to Command and Control via Application Layer Protocol, specifically leveraging OS command injection through legitimate software features that are misconfigured due to lack of input validation.
The impact extends beyond simple redirection because modern operating systems associate various URI schemes with powerful system utilities or third-party applications capable of executing scripts, launching files, or accessing sensitive data stores. For instance, if a malicious link utilizes a scheme associated with a media player or document viewer that supports scripting macros, the attacker could execute arbitrary code within the context of the vulnerable application. This bypasses traditional sandboxing mechanisms since the execution occurs through legitimate system binaries rather than injected malware payloads directly into memory. The vulnerability highlights a critical gap in secure coding practices where developers assume all hyperlink navigation is benign if it originates from trusted UI components, neglecting to enforce strict allowlists for URI schemes during runtime processing of user-generated content.
Mitigation strategies must prioritize immediate patching by upgrading Telerik UI for WPF to version 2026.4.1110 or later, where the vendor has implemented stricter validation checks on incoming URI schemes. In environments where upgrading is not immediately feasible, defensive measures should include implementing application-level whitelisting of allowed protocols before any navigation request is processed by the framework. Security teams should also enforce strict content security policies that restrict inline scripts and external resource loading within hosted web views embedded in WPF applications. Additionally, endpoint detection and response solutions can be tuned to monitor for unusual process creation events triggered by common application binaries when invoked via non-standard URI schemes, providing an additional layer of defense against exploitation attempts targeting this specific class of vulnerabilities.