Cpe:2.3:a:progress:telerik_ui_for_net_maui:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aprogresstelerik_ui_for_net_maui/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 14:16:54 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgProgress Telerik UI for .NET MAUI: URL redirection vulnerability (CVE-2026-124705)https://feed.craftedsignal.io/briefs/2026-11-telerik-ui-url-redirection-cve-2026-124705/Thu, 12 Nov 2026 14:16:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-telerik-ui-url-redirection-cve-2026-124705/Progress Telerik UI for .NET MAUI versions prior to 16.0.0 contain an untrusted URL redirection vulnerability in RadRichTextEditor and RadPdfViewer components that allows unauthenticated attackers to execute arbitrary OS protocol handlers via malicious document links.Progress Telerik UI for .NET MAUI prior to version 16.0.0 is susceptible to an untrusted URL redirection vulnerability identified as CVE-2026-124705. The flaw resides within the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling mechanisms. This issue enables an unauthenticated attacker to supply a crafted document or PDF file containing a non-allowlisted URI scheme. When a user interacts with these components to open the malicious link, the application executes arbitrary operating system protocol handlers with attacker-specified arguments.

Impact

Successful exploitation allows an attacker to launch arbitrary OS protocol handlers on the user's machine, potentially leading to unauthorized execution of system-level operations or unintended application interactions, depending on the available handlers and attacker-controlled parameters. The vulnerability has a CVSS v3.1 base score of 7.8.

Recommendation

  • Upgrade Progress Telerik UI for .NET MAUI to version 16.0.0 or later immediately to resolve the vulnerability.
  • Implement strict URI scheme allowlisting for any application utilizing Telerik RadRichTextEditor or RadPdfViewer to sanitize user-provided or document-embedded links.
  • Conduct a code review of applications integrating these Telerik components to identify how external document inputs are processed and rendered.
]]>highadvisory