Progress Telerik UI for WinForms: Deserialization of Untrusted Data (CVE-2026-124701)
Progress Telerik UI for WinForms versions prior to 2026.4.1111 contain a deserialization of untrusted data vulnerability that allows an attacker to perform unauthorized actions in the context of the affected application.
CVE search metadata
CVE search record: CVE-2026-124701. Severity: high. CVSS: 7.8. KEV: no. Product: Telerik UI for WinForms (< 2026.4.1111). Brief: Progress Telerik UI for WinForms: Deserialization of Untrusted Data (CVE-2026-124701). Brief link: https://feed.craftedsignal.io/briefs/2026-11-telerik-deserialization-cve-2026-124701/
Triage facts
Revision 1- Applicability
- Telerik UI for WinForms (< 2026.4.1111)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 14:16 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A deserialization of untrusted data vulnerability exists in Telerik UI for WinForms in versions prior to 2026.4.1111. This vulnerability allows an attacker to perform unauthorized actions in the context of the affected application.
Recommendation
Upgrade Telerik UI for WinForms to version 2026.4.1111 or later.