Progress Telerik UI for .NET MAUI: URL redirection vulnerability (CVE-2026-124705)

Progress Telerik UI for .NET MAUI prior to version 16.0.0 is susceptible to an untrusted URL redirection vulnerability identified as CVE-2026-124705. The flaw resides within the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling mechanisms. This issue enables an unauthenticated attacker to supply a crafted document or PDF file containing a non-allowlisted URI scheme. When a user interacts with these components to open the malicious link, the application executes arbitrary operating system protocol handlers with attacker-specified arguments.

Impact

Successful exploitation allows an attacker to launch arbitrary OS protocol handlers on the user's machine, potentially leading to unauthorized execution of system-level operations or unintended application interactions, depending on the available handlers and attacker-controlled parameters. The vulnerability has a CVSS v3.1 base score of 7.8.

Recommendation

• Upgrade Progress Telerik UI for .NET MAUI to version 16.0.0 or later immediately to resolve the vulnerability.
• Implement strict URI scheme allowlisting for any application utilizing Telerik RadRichTextEditor or RadPdfViewer to sanitize user-provided or document-embedded links.
• Conduct a code review of applications integrating these Telerik components to identify how external document inputs are processed and rendered.