Telerik Document Processing CVE-2026-118035

Exploitation requires that an application built on Telerik Document Processing Libraries (version prior to 2026.3.1027) feeds an attacker-controlled document into RadWordsProcessing for parsing in one of the DOCX, DOC, RTF, or HTML formats. The concrete prerequisite is an exposed document-processing path that accepts externally supplied files - e.g., an upload, import, or conversion feature - and parses them without resource limits. The decisive limiting factor is source trust: if the application only processes documents from trusted/authenticated internal sources, the practical attack surface is greatly reduced despite the network CVSS vector. Impact is confined to availability (process hang or termination); there is no path to data disclosure or code execution. The specific malformed structures that trigger the recursion/loop are not described in the available sources.

This is a denial-of-service vulnerability (CWE-674 uncontrolled recursion, plus inefficient algorithmic complexity and infinite-loop defects) in RadWordsProcessing, rated CVSS 7.5. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a network-reachable, low-complexity, unauthenticated attack with no user interaction and a pure availability impact - no confidentiality or integrity loss. The vuln.today decision label is 'this_week', indicating elevated but not emergency urgency. There is no CISA KEV listing and no EPSS score was provided, so there is no signal of active or widespread exploitation; likewise no PoC or exploit reference was supplied. The signals are internally consistent: a high-CVSS availability-only flaw with no exploitation evidence. Real-world risk is therefore moderate and context-dependent - genuinely serious for internet-facing or multi-tenant services that parse untrusted DOCX/DOC/RTF/HTML via this library (a crash or hang can take down the host process), but of limited concern where documents are only processed from trusted sources. Note that AV:N with UI:N assumes the application automatically ingests attacker-controlled documents; if a deployment only processes operator-supplied files, the practical attack surface is narrower than the network vector implies - verify how your application feeds documents to the library. EPSS and KEV data are absent rather than low, so exploitation probability cannot be quantified from the provided inputs.

An attacker uploads or submits a specially crafted DOCX, DOC, RTF, or HTML file to an application that uses RadWordsProcessing to parse it (for example, a document-conversion or ingestion endpoint). The malformed structure triggers uncontrolled recursion, pathological algorithmic complexity, or an infinite loop, causing the host process to exhaust resources and hang or terminate, denying service to all users. No public exploit code or PoC reference was provided in the input; the network vector and low attack complexity make exploitation straightforward where untrusted documents are processed.