Read the docs
TI-2026-69265 Aliases CVE-2026-106164GHSA-3g99-jr36-v2mm

Infinite loop in Telerik Document Processing XLS import

Priority LOW 37CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-835.

Summary

Progress Telerik Document Processing SpreadProcessing library from 2026.3.811 before 2026.3.1006 contains an infinite loop flaw (CWE-835) when importing an XLS file. The import timeout is ignored when the file is specifically corrupted, which leaves a CPU thread unresponsive. An unauthenticated remote attacker can trigger this by supplying a crafted XLS file, causing denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

In Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists when importing an XLS file with a specifically-targted corruption, the import timeout is ignored resulting in an unresponsive CPU thread and denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00186 8th percentileScored 2026-11-07
Fix Fixed Telerik Document Processing Libraries (Progress Software): 2026.3.1006

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressTelerik Document Processing Libraries2026.3.811 to before 2026.3.10062026.3.1006Patch availableCNA
  • Telerik Document Processing Libraries VendorProgress Affected 2026.3.811 to before 2026.3.1006 Fixed in 2026.3.1006 Patch available CNA

Remediation

Upgrade Telerik Document Processing Libraries to version 2026.3.1006 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Telerik Document Processing Libraries (Progress Software) Fixed in 2026.3.1006

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-106164
  2. 2026-10-07 CISA SSVC decision points changed
  3. 2026-10-07 Priority changed: MEDIUM → LOW
  4. 2026-10-07 Alias added: GHSA-3g99-jr36-v2mm

References

Advisory 1

  • TI-2026-07083 Command injection in Progress LoadMaster KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-06182 WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-04541 WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-04060 Registration Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-01127 LoadMaster Pre-Authenticated OS Command Injection KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-20934 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability KEVCVSS 3.1CRITICAL 10.0
See all 436 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences