CVE-2026-118036

HighCVSS 7.5/10Last modified Nov 12, 2026

Description

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or hang the host process via a crafted PDF document or document text submitted for summarization or question answering.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-407 CWE-674 CWE-770 CWE-789 CWE-835

Affected software

Vendor	Product	Versions
Progress Software	Telerik Document Processing Libraries	< 2026.3.1027

References

https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-uncontrolled-resource-consumption-pdfprocessing-cve-2026-118036Vendor Advisory

Timeline

Published: Oct 28, 2026
Last modified: Nov 12, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1180377.5In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop cond CVE-2026-1180387.1In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI CVE-2026-1180397.5In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG imag CVE-2026-118045.2Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niaga CVE-2026-1180407.5In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and impr CVE-2026-1180418.8The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale file-replacemen CVE-2026-1180437.2The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, all CVE-2026-1180458.7The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed director CVE-2026-1180466.4The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the CVE-2026-1180476.4The Falang multilanguage for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'falang_term[<taxonomy>][<l CVE-2026-1180486.4The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Simple Form autocomplete lookup label in versio CVE-2026-1180506.4The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shouttext' parameter in all versions up to, and