CVE-2026-124705

CVSS 7.8 (high) · published 2026-11-12

In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens.

Weakness: CWE-601

Source: NVD CVE-2026-124705

References

• https://www.telerik.com/maui-ui/documentation/knowledge-base/kb-security-untrusted-url-redirection-cve-2026-124705

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.