Progress Telerik Document Processing 2026.3.1027 Fixes Six Flaws
Tech GuruQuick Answer
Progress Telerik Document Processing 2026.3.1027 fixes six high-severity vulnerabilities across AI tools and document parsers. Inventory library versions and untrusted document paths, upgrade, validate conversion and signature workflows, review exposure where warranted, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory applications and services that bundle Telerik Document Processing, exact package versions, AI agent tools, SVG, PDF, Word and spreadsheet ingestion paths, process privileges, owners, and deployment pipelines. Match each parser or tool to its advisory and version range; do not infer that an application is remotely exposed without tracing how untrusted files, text or tool arguments reach the library. Upgrade every deployed copy and maintained build to Telerik Document Processing Libraries 2026.3.1027 or later, rebuild dependent applications, and restrict untrusted document processing while rollout is pending. Confirm resolved package versions in builds and runtime artifacts, test conversion, PDF signature validation, AI document functions and spreadsheet workflows, exercise malformed-file safeguards, and retain dependency and change evidence.
Last verified: 2026-10-28 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Progress Telerik Document Processing Libraries, including Words, PDF, Spread and AI agent tools |
|---|---|
| Advisory | Progress CVE-2026-118035 / Progress CVE-2026-118036 / Progress CVE-2026-118037 / Progress CVE-2026-118038 / Progress CVE-2026-118039 / Progress CVE-2026-118040 |
| CVEs | CVE-2026-118035, CVE-2026-118036, CVE-2026-118037, CVE-2026-118038, CVE-2026-118039, CVE-2026-118040 |
| Authoritative release date | 2026-10-28 12:27:47.560 UTC |
| Authority revision date | 2026-10-28 12:34:09.534 UTC |
| Affected versions | Telerik Document Processing Libraries before 2026.3.1027; the path-traversal issue starts with 2026.1.210 and the SVG XXE issue starts with 2024.3.802, while the other advisory ranges cover prior releases. |
| Fixed version | Progress Telerik Document Processing Libraries 2026.3.1027 or later |
| CVSS base score | 7.1 and 7.5 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | Progress does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Progress fixed file read or overwrite through AI tool path traversal, local-file disclosure through SVG XXE, forged PDF signature or certificate validation, and denial of service in Words, PDF and spreadsheet processing.
What To Validate Now
- Inventory. Inventory applications and services that bundle Telerik Document Processing, exact package versions, AI agent tools, SVG, PDF, Word and spreadsheet ingestion paths, process privileges, owners, and deployment pipelines.
- Establish applicability. Match each parser or tool to its advisory and version range; do not infer that an application is remotely exposed without tracing how untrusted files, text or tool arguments reach the library.
- Remediate. Upgrade every deployed copy and maintained build to Telerik Document Processing Libraries 2026.3.1027 or later, rebuild dependent applications, and restrict untrusted document processing while rollout is pending.
- Validate. Confirm resolved package versions in builds and runtime artifacts, test conversion, PDF signature validation, AI document functions and spreadsheet workflows, exercise malformed-file safeguards, and retain dependency and change evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The signature issue can report forged content as unmodified, while the resource-consumption issues can terminate a host process. Treat parser isolation and input limits as defense in depth, not substitutes for the update.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
- Progress CVE-2026-118035
- Progress CVE-2026-118036
- Progress CVE-2026-118037
- Progress CVE-2026-118038
- Progress CVE-2026-118039
- Progress CVE-2026-118040
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
