CVE-2026-106164highCWE-835

CVE-2026-106164: high-severity vulnerability in Progress Software Telerik Document Processing…

Infinite Loop in Telerik Document Processing XLS Import

Published

18Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3
exploitation probability
—
observed exploitation
nono source reports it
In Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists when importing an XLS file with a specifically-targted corruption, the import timeout is ignored resulting in an unresponsive CPU thread and denial of service.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
Progress Software · Telerik Document Processing Libraries
Related CVEs — Progress Software Telerik Document Processing…

In the same product, most dangerous first.

CVE-2024-11343HIGHTelerik Document Processing Path TraversalEPSS 0.7%CVE-2024-8049MEDIUMTelerik Document Processing Improper Handling of Memory ResourcesEPSS 0.4%
References
https://www.telerik.com/document-processing-libraries/documentation/knowledge-base/kb-security-import-infinite-loop-cve-2026-106164