CVE-2026-106164: CWE-835 Loop with unreachable exit condition ('infinite loop') in Progress Software Telerik Document Processing Libraries

The vulnerability identified as CVE-2026-106164 affects the Progress Telerik Document Processing SpreadProcessing library. Versions >=2026.3.811 and <2026.3.1006 are vulnerable to an infinite loop condition (CWE-835) when importing XLS files containing a specific corruption. This infinite loop causes the import timeout mechanism to be bypassed, resulting in a denial of service due to an unresponsive CPU thread. The CVSS 3.1 base score is 7.3, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation results in denial of service by causing the application thread handling the XLS import to become unresponsive due to an infinite loop. This can degrade service availability and potentially impact system stability. Confidentiality and integrity impacts are rated low, indicating limited data exposure or modification risk.

A fix is available in version 2026.3.1006 of the Telerik Document Processing SpreadProcessing library. Users should upgrade to this version or later to remediate the vulnerability. No additional mitigation steps are indicated in the vendor advisory.