CVE-2026-118037
HIGHDescription
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular expression vulnerabilities in RadSpreadProcessing and RadSpreadStreamProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted XLSX or XLS workbook or formula.
Is your site exposed to CVE-2026-118037?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2026-118037? +
How severe is CVE-2026-118037? +
How do I check if I'm vulnerable to CVE-2026-118037? +
Related Vulnerabilities
A denial of service (DoS) vulnerability in Palo Alto Networks Prisma SD-WAN ION devices enables an unauthenticated attacker in a …
smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop …
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with …
An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive …
An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive …
Unchecked input for loop condition (CWE-606) in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and …
