Vulnerability · Published May 15, 2024 · Assigned by ProgressSoftware
CVE-2024-3892Local code execution vulnerability in Telerik UI for WinForms
High 7.2
In plain English
A high-severity code injection in Telerik UI for WinForms from Progress Software Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.2%top 87.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A local code execution vulnerability is possible in Telerik UI for WinForms beginning in v2021.1.122 but prior to v2024.2.514. This vulnerability could allow an untrusted theme assembly to execute arbitrary code on the local Windows system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software Corporation | Telerik UI for WinForms | v2021.1.122 – before v2024.2.514 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H