The vulnerability in Telerik UI for ASP.NET AJAX's RadAsyncUpload component arises from missing cumulative size enforcement when reassembling uploaded file chunks. This flaw allows attackers to bypass the maximum file size restriction by uploading multiple chunks that collectively exceed the limit, resulting in uncontrolled resource consumption. The consequence is potential disk space exhaustion, impacting system availability. The issue affects versions prior to 2026.1.421, including version 2011.2.712. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, no privileges required, no user interaction, and impact limited to availability.

Successful exploitation leads to denial of service through disk space exhaustion, impairing system availability. There is no impact on confidentiality or integrity. The vulnerability does not require authentication or user interaction, making it remotely exploitable over the network. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing upload size monitoring and limiting mechanisms at network or application firewall levels to detect and block abnormal upload patterns. Review and restrict access to the RadAsyncUpload component where possible to reduce exposure.