{"id":"CVE-2026-118035","aliases":[],"cve":{"records":[{"id":"CVE-2026-118035","source":"ProgressSoftware","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-27T15:05:16.963Z","published":"2026-10-28T12:31:56.249Z","modified":"2026-10-28T12:31:56.249Z"}],"publishers":[{"name":"ProgressSoftware","role":"CNA","organizationId":"f9fea0b6-671e-4eea-8fde-31911902ae05","modified":"2026-10-28T12:31:56.249Z"}],"references":[{"url":"https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-uncontrolled-resource-consumption-wordsprocessing-cve-2026-118035","tags":["vendor-advisory"],"source":"ProgressSoftware"}],"weaknesses":[{"id":"CWE-674","description":"CWE-674 Uncontrolled Recursion","source":"ProgressSoftware"},{"id":"CWE-407","description":"CWE-407 Inefficient Algorithmic Complexity","source":"ProgressSoftware"},{"id":"CWE-835","description":"CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')","source":"ProgressSoftware"}],"applicability":[],"prioritization":[]},"title":"Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing","titleSource":"ProgressSoftware","descriptionSource":"ProgressSoftware","description":"In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in RadWordsProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted DOCX, DOC, RTF or HTML document.","score":7.5,"severity":"high","published":"2026-10-28T12:31:56.249Z","modified":"2026-10-28T12:31:56.249Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Progress Software","name":"Telerik Document Processing Libraries","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"2026.3.1027","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"ProgressSoftware","url":"https://www.cve.org/CVERecord?id=CVE-2026-118035"}],"remediation":[],"references":["https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-uncontrolled-resource-consumption-wordsprocessing-cve-2026-118035"],"sources":[{"name":"CVE","id":"CVE-2026-118035","modified":"2026-10-28T12:31:56.249Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118035"}],"assessments":[{"source":"ProgressSoftware","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-29T14:37:02.837Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:10:30.844Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Telerik Document Processing Libraries prior to version 2026.3.1027 have vulnerabilities in RadWordsProcessing, allowing an unauthenticated attacker to terminate or hang the host process via a crafted document. The weaknesses include uncontrolled recursion, inefficient algorithmic complexity, and infinite loop vulnerabilities.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:42:19.450Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118035"}]}}