CVE-2026-106164

EUVD-2026-94545
In Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists when importing an XLS file with a specifically-targted corruption, the import timeout is ignored resulting in an unresponsive CPU thread and denial of service.
Infinite Loop
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
ProgressSoftwareCNA
7.3 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 7.56%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
progresstelerik_document_processing_libraries
2026.3.811 ≤
𝑥
< 2026.3.1006
CNA
Common Weakness Enumeration
References
https://www.telerik.com/document-processing-libraries/documentation/knowledge-base/kb-security-import-infinite-loop-cve-2026-106164