Telerik SpreadProcessing EUVD-2026-94545

Exploitation requires an application built on the Telerik SpreadProcessing library (versions prior to 2026.3.1006) to import an attacker-supplied XLS file containing a specifically-targeted corruption; the crafted structure causes the import routine to loop indefinitely and bypass the library's configured import timeout, so the timeout safeguard provides no protection. Exploitation is limited by whether the host application actually exposes an XLS import path to untrusted input - purely internal/trusted import workflows are not realistically reachable by external attackers. The flaw affects the XLS import format specifically (not inherently other formats) and is remediated by upgrading to 2026.3.1006 or later.

This is a denial-of-service vulnerability (CWE-835, infinite loop) in the Telerik SpreadProcessing library, triggered when a specially-corrupted XLS file is imported and the import timeout is ignored. The vendor-supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, score 7.3) is internally inconsistent with the described impact: a DoS caused by an unresponsive CPU thread should present as availability-only (A:H, C:N, I:N), yet the vector claims low confidentiality and integrity impact with only low availability impact - this is a data-quality concern and the real-world impact is availability, not data disclosure or tampering. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Practical risk is moderate and context-dependent: because this is a developer library rather than a standalone service, exploitability hinges entirely on whether a downstream application built on SpreadProcessing accepts and imports attacker-controlled XLS files. Where such an upload/import path exists, a single crafted file can pin a worker thread indefinitely; where imports are limited to trusted internal files, real risk is low. The AV:N rating reflects the library's use in server-side import pipelines rather than any inherent network listener.

An attacker uploads a maliciously-corrupted XLS file to a web application or service that uses Telerik SpreadProcessing to parse spreadsheets. When the application imports the file, the parser enters an infinite loop and ignores its configured import timeout, pinning a CPU thread and degrading or denying service to legitimate users. No public exploit code was identified at time of analysis, though the corruption technique is deterministic and would be straightforward to reproduce.