Read the docs
TI-2024-09293 Aliases CVE-2024-10013GHSA-gxmf-6vg5-f87h

Progress UI for WinForms format provider unsafe deserialization vulnerability

Priority LOW 35CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

In Progress Telerik UI for WinForms versions prior to 2024 Q4 (2024.4.1113), a code execution attack is possible through an insecure deserialization vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00222 12th percentileScored 2026-11-07
Fix Fixed Telerik UI for WinForms (Progress Software): 2024.4.1113

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressTelerik UI for WinForms2011.1.315 to before 2024.4.11132024.4.1113Patch availableCNA
  • Telerik UI for WinForms VendorProgress Affected 2011.1.315 to before 2024.4.1113 Fixed in 2024.4.1113 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:progress:telerik_ui_for_winforms:*:*:*:*:*:*:*:*before 2024.4.1113VulnerableProgress
  • cpe:2.3:a:progress:telerik_ui_for_winforms:*:*:*:*:*:*:*:* Versions before 2024.4.1113 Vulnerable ·Progress

Remediation

  • Fix · CNA Telerik UI for WinForms (Progress Software) Fixed in 2024.4.1113

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10013
  2. 2026-10-03 Alias added: GHSA-gxmf-6vg5-f87h

References

Advisory 1

  • TI-2025-00267 Progress UI for WinForms decompression path traversal vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-03632 Local code execution vulnerability in Telerik UI for WinForms CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences