Deserialization of Untrusted Data Vulnerability (CVE-2026-124701)
Description
November 2026 - CVE-2026-124701
- Telerik UI for WinForms 2026 Q3 2026.3.1007 or earlier.
What Are the Impacts
In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.
Issue
- CWE-502: Deserialization of Untrusted Data
- CAPEC-586: Object Injection
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
>= 0 && <= 2026.3.1007 | >= 2026.4.1111 |
Follow the update instructions for precise instructions. All customers who have a license for Telerik UI for WinForms can access their downloads here Product Downloads | Your Account.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
External References
CVE-2026-124701 (High)
CVSS: 7.8
In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.