Progress Telerik UI for WinForms: Untrusted URL Redirection (CVE-2026-124700)
An untrusted URL redirection vulnerability in Telerik UI for WinForms allows attackers to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents or hyperlinks.
CVE search metadata
CVE search record: CVE-2026-124700. Severity: high. CVSS: 7.8. KEV: no. Product: Telerik UI for WinForms (< 2026.4.1111). Brief: Progress Telerik UI for WinForms: Untrusted URL Redirection (CVE-2026-124700). Brief link: https://feed.craftedsignal.io/briefs/2026-11-telerik-winforms-redirect-cve-2026-124700/
Triage facts
Revision 1- Applicability
- Telerik UI for WinForms (< 2026.4.1111)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 18:50 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
An untrusted URL redirection vulnerability exists in Telerik UI for WinForms, which allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks containing a non-allowlisted URI scheme when opened by a user.