CVE-2026-124705 in Telerik UI for .NET MAUI
Summary
by MITRE • 11/12/2026
In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/12/2026
The identified security flaw resides within the Progress Telerik UI for .NET MAUI framework, specifically affecting versions prior to 16.0.0. This vulnerability impacts two primary components: the RadRichTextEditor and the RadPdfViewer controls. The core issue is an untrusted URL redirection weakness that stems from insufficient validation of Uniform Resource Identifier (URI) schemes when processing hyperlinks embedded within documents or PDF files. When a user interacts with these controls to open a link, the application fails to adequately restrict which protocol handlers can be invoked by the operating system. This lack of strict allowlisting for URI schemes creates a pathway for an unauthenticated attacker to exploit the trust relationship between the UI component and the underlying host environment.
From a technical perspective, the vulnerability allows for arbitrary command execution through the abuse of operating system protocol handlers. Modern operating systems associate specific URI schemes with applications or services capable of handling them. For instance, schemes like file://, mailto:, or custom application-specific protocols can trigger external programs to launch with arguments provided in the URL. In this scenario, an attacker crafts a malicious document or PDF containing a hyperlink that utilizes a non-allowlisted scheme designed to execute system commands or access sensitive local resources. Because the Telerik controls do not validate whether the URI scheme is safe before passing it to the OS handler, they effectively act as a conduit for launching arbitrary processes on the victim's machine with the privileges of the current user session.
The operational impact of this vulnerability is significant, particularly in enterprise environments where users frequently open documents from untrusted sources such as email attachments or web downloads. An attacker can leverage this flaw to perform actions that compromise system integrity and data confidentiality. Potential consequences include the execution of malicious payloads, exfiltration of sensitive local files via file:// protocols, or interaction with other installed applications through custom URI schemes. This type of attack falls under the category of client-side code injection and is particularly dangerous because it bypasses traditional network-based security controls by leveraging legitimate application functionality to trigger system-level actions. The vulnerability aligns closely with CWE-918, which addresses Server-Side Request Forgery (SSRF) variants that involve protocol manipulation, as well as CWE-20 regarding improper input validation. Furthermore, in the context of the MITRE ATT&CK framework, this behavior maps to techniques involving command and script interpretation or system service execution via client-side exploits, specifically relating to how applications handle external inputs without proper sanitization.
To mitigate this risk, organizations must prioritize upgrading the Progress Telerik UI for .NET MAUI library to version 16.0.0 or later, where these validation checks have been implemented by the vendor. Until an upgrade is feasible, defensive measures should focus on restricting user access to untrusted documents and implementing strict content security policies if applicable within the application's broader architecture. Developers reviewing existing codebases should audit any custom implementations of hyperlink handling in RadRichTextEditor or RadPdfViewer instances to ensure that only a predefined whitelist of safe URI schemes such as http, https, and ftp are permitted for navigation. Additionally, employing endpoint detection and response solutions can help monitor for unusual process launches triggered by document interactions, providing an additional layer of defense against exploitation attempts targeting this specific class of vulnerabilities.