Telerik Document Processing Libraries CVE-2026-118040

The target application must use Progress Telerik Document Processing Libraries' RadPdfProcessing (version prior to 2026.3.1027) to validate PDF digital signatures AND must rely on that validation result as a trust/authenticity decision. The attacker supplies a crafted signed PDF whose forged content is nonetheless reported as unmodified with a valid signing certificate. Limiting factors: the vulnerable code is only reached when the application actually performs signature verification via this library; applications that do not verify PDF signatures, or that do not act on the verification outcome, are not meaningfully exposed. Exploitation requires no authentication and no user interaction per the vendor vector, but does require that the attacker-controlled PDF reaches the validation routine.

This is a signature-validation bypass (CWE-347) rated CVSS 7.5 with an integrity-only impact profile (C:N/I:H/A:N). The vendor-supplied vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N describes a network-reachable, low-complexity, unauthenticated issue, which maps to the real mechanism reasonably well: the attacker simply supplies a crafted signed PDF and the vulnerable RadPdfProcessing code validates it. There is no availability or confidentiality loss - the danger is that forged content is reported as unmodified and its signing certificate as valid, defeating the trust guarantee the signature is supposed to provide. On the decision signals, the vuln.today priority is 'this_week' (not act_now/emergency); there is no CISA KEV listing, no EPSS score supplied, and no public PoC or exploit reference in the input, so there is no indication of active or imminent widespread exploitation. The realistic priority is therefore moderate-and-prompt rather than drop-everything: the practical impact is high only for deployments that actually rely on RadPdfProcessing signature verification as a security/trust control (e.g. validating contracts, invoices, or compliance documents). Note one nuance to verify: AV:N/PR:N/UI:N implies fully remote unauthenticated reach, but exploitation in practice requires the target application to ingest and validate an attacker-supplied PDF - how exposed that path is depends on the deployment, so treat 'network, no interaction' as best-case for the attacker rather than guaranteed for every integration.

An attacker modifies the contents of a legitimately signed PDF (or crafts a new one) so that RadPdfProcessing's signature validation still reports the document as unmodified and the signing certificate as valid. A business application that accepts and verifies signed PDFs - for example an automated invoice, contract, or compliance-document pipeline - then treats the forged document as authentic and acts on it. No public exploit identified at time of analysis; the attack is low-complexity and needs no authentication or user interaction once a validation path is reachable.