Telerik Document Processing CVE-2026-118036

Exploitation requires that an application built on Telerik Document Processing Libraries (prior to 2026.3.1027) accept attacker-controlled input via one of two named paths: a crafted PDF document processed by RadPdfProcessing, or document text submitted to the AI document summarization and question-answering features. The attacker needs reachability to whatever endpoint ingests these documents; no authentication (PR:N) and no user interaction (UI:N) are required by the CVSS vector. The practical limiting factor is deployment-specific: the flaw is only reachable where the host application exposes PDF upload or AI summarization intake to untrusted users - installations that process only trusted internal documents are not realistically exposed. Impact is limited to denial of service (process hang or termination); there is no data disclosure or code execution. The only complete fix stated by the vendor is upgrading to version 2026.3.1027.

This is a genuine but moderate-priority availability issue, not a high-severity emergency. The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N) reflects the worst case of a network-reachable, unauthenticated, low-complexity denial of service, with impact confined entirely to availability (C:N/I:N/A:H) - there is no confidentiality or integrity exposure. The vuln.today decision label is 'this_week' rather than act_now/emergency, which aligns with a DoS-only outcome. No EPSS score, CISA KEV listing, or public PoC/exploit reference is present in the supplied data, so there is no evidence of active exploitation or available exploit code; exploitation status is accordingly 'no public exploit identified at time of analysis.' The main caveat is that the AV:N rating assumes the vulnerable Telerik library is embedded in an application that accepts attacker-supplied PDFs or document text over the network (e.g. an upload or AI summarization endpoint); in deployments where the library only processes trusted internal documents, real-world reachability is much lower than the network vector implies. CWE-674 (uncontrolled recursion), plus the infinite-loop and resource-allocation classes named by the vendor, are consistent with the availability-only impact.

An attacker submits a specially crafted PDF to an application that uses Telerik RadPdfProcessing, or supplies malicious document text to an AI summarization/question-answering endpoint built on the affected libraries. The malformed input triggers uncontrolled recursion, an infinite loop, or excessive resource allocation, causing the host process to hang or terminate and denying service to legitimate users. No public exploit code is identified in the available data, and no authentication or user interaction is required (PR:N/UI:N).