Deserialization Vulnerability in Telerik UI for WinForms
CVE-2026-124701

7.8HIGH

Key Information:

Vendor: Progress Software
Status: Telerik Ui For Winforms
Vendor: CVE Published:; 12 November 2026

🔔 Create Progress Software Vulnerability Alert

What is CVE-2026-124701?

A security vulnerability exists in Telerik UI for WinForms that allows attackers to execute unauthorized actions due to improper handling of deserialized data. This issue arises when untrusted data is deserialized, which can lead to the execution of malicious code within the context of the application. It is crucial for users to upgrade to version 2026.4.1111 or later to mitigate this risk.

Affected Version(s)

Telerik UI for WinForms 2026.3.1007 < 2026.4.1111

References

https://www.telerik.com/products/winforms/documentation/k...

vendor-advisory

CVSS V3.1

Score:

7.8

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 12, 2026
Vulnerability Reserved
Nov 9, 2026

CVE-2026-124701 Data

JSON