CVE-2026-118037 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop cond

High 7.5 Published 28 Oct 2026 Updated 28 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-118037?

CVE-2026-118037 is a high-severity vulnerability in Progress Software Telerik Document Processing Libraries, published on 28 Oct 2026.

Official description

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular expression vulnerabilities in RadSpreadProcessing and RadSpreadStreamProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted XLSX or XLS workbook or formula.

Weakness: CWE-835, CWE-674, CWE-606, CWE-1333

Which versions are affected by CVE-2026-118037?

How do I fix CVE-2026-118037?

No fix has been published for CVE-2026-118037 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-118037 being exploited?

There is no known exploitation of CVE-2026-118037 in the wild and no public exploit code.

Sources

Also known as GHSA-qc7q-37q2-hh52.