Telerik Document Processing Libraries EUVD-2026-112039

Exploitation requires that the host application parse an attacker-controlled XLSX or XLS workbook (or an embedded formula) using the RadSpreadProcessing or RadSpreadStreamProcessing components of Telerik Document Processing Libraries at a version prior to 2026.3.1027. The practical precondition is an application feature that accepts and processes untrusted spreadsheet files (upload, import, or conversion); where only trusted internal documents are processed, the unauthenticated remote path effectively does not apply. Per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are required at the library level. The only complete fix per the vendor is updating to 2026.3.1027 or later; no other mitigation is stated in the available evidence. Impact is limited to availability - a hung or terminated process - with no data exposure or code execution.

This is a denial-of-service vulnerability (CWE-674, uncontrolled recursion, plus infinite-loop, unchecked-loop-condition and inefficient-regex issues) in Progress Telerik Document Processing Libraries' RadSpreadProcessing and RadSpreadStreamProcessing components. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated issue with impact limited strictly to availability - no confidentiality or integrity loss. The AV:N rating is realistic only where the host application accepts attacker-supplied XLSX/XLS workbooks or formulas (e.g. an upload or document-conversion endpoint); for applications that only process trusted internal files the practical attack surface is narrower, so the network vector is contingent on deployment. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present in the input - so there is no public exploit identified at time of analysis, and the only exploitation signal is the vendor's own advisory plus a vuln.today 'this_week' priority label. Net: a genuine but availability-only risk worth patching on a normal priority cadence (the input's decision label is 'this_week', not act_now/emergency); it is not a high-CVSS-but-illusory issue because unauthenticated DoS is plausible wherever untrusted spreadsheets are parsed, but its ceiling is a hung or terminated process, not code execution or data exposure.

An attacker submits a specially crafted XLSX or XLS workbook - or a workbook containing a malicious formula - to an application that parses it with Telerik RadSpreadProcessing or RadSpreadStreamProcessing (for example a file-upload or document-conversion feature). Parsing triggers uncontrolled recursion, an infinite loop, or catastrophic regular-expression backtracking, causing the host process to hang or terminate and denying service to legitimate users. No public exploit or PoC was identified in the available data; the trigger is attributed to the four listed flaw classes but the exact crafted structure is not described in the sources.