Threats affecting pkg:nuget/telerik.documentprocessinglibraries

CVE-2026-118037 affects Progress Software's Telerik Document Processing Libraries prior to version 2026.3.1027. The vulnerability involves uncontrolled recursion, infinite loops, unchecked loop conditions, and inefficient regular expressions in RadSpreadProcessing and RadSpreadStreamProcessing components. An unauthenticated attacker can exploit this by crafting malicious XLSX or XLS workbooks or formulas to cause the host process to hang or terminate unexpectedly. This issue has been fixed in version 2026.3.1027.

A vulnerability in Progress Telerik Document Processing Libraries prior to version 2026.3.1027 allows improper verification of cryptographic signatures and certificate validation in RadPdfProcessing. This flaw enables an unauthenticated attacker to craft a signed PDF document that causes the signature validation to incorrectly report forged content as unmodified and the signing certificate as valid.

CVE-2026-118038 is a path traversal vulnerability in Progress Software's Telerik Document Processing Libraries prior to version 2026.3.1027. It affects the Convert and Merge AI agent tools, allowing an authenticated low-privilege attacker who can supply tool arguments to read and overwrite files outside the configured output directory using relative file paths. The vulnerability is fixed in version 2026.3.1027.