This vulnerability (CVE-2026-13182) in Telerik UI for ASP.NET AJAX prior to version 2026.2.708 involves the RadAsyncUpload component's client-state processing. It improperly distinguishes decrypt failures from invalid JSON parse failures, effectively creating an oracle that leaks protected metadata to remote attackers. This is classified under CWE-209, which concerns the generation of error messages containing sensitive information. The vulnerability affects version =2010.1.309 as explicitly stated. No official patch or remediation level is currently provided by the vendor, and no known exploits are reported in the wild.

The vulnerability allows remote attackers to gain access to protected metadata values by exploiting error message differences, leading to a confidentiality breach. There is no reported impact on integrity or availability. The CVSS 3.1 score of 7.5 reflects a high severity primarily due to the confidentiality impact with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Progress Software advisories for updates. Until a patch is available, consider restricting access to the affected component and reviewing error handling configurations to avoid leaking sensitive information.