Vulnerability · Published Oct 28, 2026 · Assigned by ProgressSoftware

CVE-2026-118040Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing

High 7.5

In plain English

A high-severity improper certificate validation in Telerik Document Processing Libraries from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)<0.1%top 99.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticated attacker to cause signature validation to report forged content as unmodified and its signing certificate as valid via a crafted signed PDF document.

Affected products (as reported)

Vendor	Product	Versions
Progress Software	Telerik Document Processing Libraries	0 – before 2026.3.1027

Weakness: CWE-347, CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-improper-verification-of-cryptographic-signature-cve-2026-118040 vendor-advisory