Unsafe Deserialization Vulnerability (10013)
Description
Product Alert – November 2024 - CVE-2024-10013
- Telerik UI for WinForms 2024 Q3 (2024.3.924) or earlier.
Issue
CWE-502: Deserialization of Untrusted Data
What Are the Impacts
In Progress® Telerik® UI for WinForms versions prior to 2024 Q4 (2024.4.1113), a code execution attack is possible through an insecure deserialization vulnerability when loading external document styles for RichTextBox.
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
Current Version | Guidance |
---|---|
2024 Q3 (2024.3.924) or earlier | Update to 2024 Q4 (2024.4.1113) (update instructions) |
All customers who have a Telerik UI for WinForms license can access the downloads here Product Downloads | Your Account.
Notes
- If a project is not using the RichTextBox, the application is not affected by this vulnerability.
- To check your version of Telerik UI for WinForms
- Via source code: Inspect the Version property of any of the
Telerik.WinControls.*
assembly references in the project. - Via deployed application: Locate any
Telerik.WinControls.*.dll
file in the application's directory, right-click, select Properties and view the Version in the Details tab.
- Via source code: Inspect the Version property of any of the
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to Telerik customers with an active support plan.
External References
CVE-2024-10013 (HIGH)
CVSS: 7.8
In Progress® Telerik® UI for WinForms versions prior to 2024 Q4 (2024.4.1113), a code execution attack is possible through an insecure deserialization vulnerability.