CVE-2026-106164— Infinite Loop in Telerik Document Processing XLS Import
Quick assessment
Affected
Progress Software Telerik Document Processing Libraries
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Telerik® 的 In Progress® Document Processing SpreadProcessing 库中，2026.3.1006 版本之前存在一个无限循环漏洞。当导入一个经过特定方式损坏的 XLS 文件时，该漏洞会导致导入超时设置被忽略，从而造成 CPU 线程无响应，最终引发拒绝服务（DoS）问题。
Possible ATT&CK Techniques 1 AI
T1496 · Resource HijackingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progress Software | Telerik Document Processing Libraries | 2026.3.811< 2026.3.1006 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106164
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Infinite Loop in Telerik Document Processing XLS Import
Source: CVE Program / CVE List V5
Vulnerability Description
In Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists when importing an XLS file with a specifically-targted corruption, the import timeout is ignored resulting in an unresponsive CPU thread and denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software | Telerik Document Processing Libraries | 2026.3.811 ~ 2026.3.1006 | - |
|
II. Public POCs for CVE-2026-106164
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106164
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-106164 (1)
IV. Related Vulnerabilities
Same vendor: Progress Software
-
CVE-2026-91140
OS command injection in Progress Software Autonomous REST Co -
CVE-2026-92931
CWE-918: Server-Side Request Forgery in the Progress Sitefin -
CVE-2026-77805
Weak Executable Signature Verification Vulnerability in Prog -
CVE-2026-77804
Time-of-check Time-of-use (TOCTOU) Race Condition in Root Ce -
CVE-2026-77803
Front-end Desynchronization Vulnerability in Progress® Teler
Same weakness: CWE-835
-
CVE-2026-106568
ImageMagick: Infinite Loop when reading a crafted XMP profil -
CVE-2026-107168
M17n-lib: parser infinite loop on malformed utf-8 in count_u -
CVE-2026-106121
RabbitMQ: JSONReader in the default JSON-RPC mapper never te -
CVE-2026-106116
ImageSharp: BigTIFF IFD count can keep a decoder thread in a -
CVE-2026-88252
Sssd: sssd: denial of service via responder connection retry
V. Comments for CVE-2026-106164
No comments yet