CVE-2024-10012: Telerik UI for WPF RCE Vulnerability

CVE-2024-10012 Overview

CVE-2024-10012 is an insecure deserialization vulnerability in Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1111). The flaw allows code execution when the application deserializes attacker-controlled data. Exploitation requires local access and user interaction, but successful attacks yield high impact to confidentiality, integrity, and availability. Progress Software addressed the issue in the 2024 Q4 release. The vulnerability is tracked under [CWE-502: Deserialization of Untrusted Data].

Critical Impact
Attackers who deliver a crafted serialized payload to a vulnerable Telerik UI for WPF application can execute arbitrary code in the context of the running user.

Affected Products

Progress Telerik UI for WPF versions prior to 2024.4.1111 (2024 Q4)
Applications built with the vulnerable Telerik UI for WPF libraries
Desktop deployments embedding affected Telerik WPF controls

Discovery Timeline

2024-11-13 - CVE-2024-10012 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10012

Vulnerability Analysis

The vulnerability resides in deserialization logic within Telerik UI for WPF. The affected code paths accept serialized data and reconstruct .NET objects without validating the type or content of the incoming stream. An attacker who supplies a crafted payload can trigger gadget chains during object reconstruction. These gadget chains can invoke arbitrary methods, leading to code execution in the process hosting the WPF control.

Because the attack vector is local and requires user interaction, exploitation typically involves convincing a user to open a malicious file, project, or configuration handled by a vulnerable application. Once processed, the payload executes with the privileges of the current user.

Root Cause

The root cause is unsafe use of .NET deserialization primitives on untrusted input. Formatters that permit arbitrary type instantiation, such as BinaryFormatter, allow attacker-influenced streams to reference dangerous types. Without a type allowlist or safe formatter, deserialization becomes a code execution primitive. See the Telerik Security Advisory for CVE-2024-10012 for vendor detail.

Attack Vector

An attacker crafts a serialized payload containing a known .NET gadget chain. The payload is delivered through a file, document, or data source that the target application loads. When the vulnerable Telerik component deserializes the input, the gadget chain executes attacker-chosen code. The attacker gains execution in the user context, enabling persistence, credential theft, or lateral movement.

No verified public proof-of-concept code is available. Refer to the vendor advisory for technical remediation details.

Detection Methods for CVE-2024-10012

Indicators of Compromise

Unexpected child processes spawned by WPF applications embedding Telerik controls, such as cmd.exe, powershell.exe, or scripting hosts
Loading of serialization-related assemblies followed by process injection or network egress
Files with serialized .bin, .dat, or custom project extensions delivered from untrusted sources to endpoints running Telerik-based applications

Detection Strategies

Inventory managed endpoints for applications shipping Telerik UI for WPF assemblies below 2024.4.1111 using software asset management data
Alert on process lineage where a Telerik-based WPF host launches interpreters, LOLBins, or unsigned binaries
Hunt for use of legacy .NET formatters such as BinaryFormatter, NetDataContractSerializer, or SoapFormatter in loaded modules

Monitoring Recommendations

Collect endpoint telemetry covering process creation, module loads, and file writes for WPF applications built on Telerik controls
Monitor user-opened files that trigger deserialization workflows within business applications
Correlate suspicious child-process activity from WPF processes with outbound network connections to identify post-exploitation behavior

How to Mitigate CVE-2024-10012

Immediate Actions Required

Upgrade Progress Telerik UI for WPF to version 2024.4.1111 or later across all development and production builds
Rebuild and redistribute internal applications that statically reference the vulnerable Telerik assemblies
Restrict opening of untrusted files, projects, or data sources in applications known to embed Telerik WPF controls

Patch Information

Progress released a fixed build in Telerik UI for WPF 2024 Q4 (2024.4.1111). Application owners must update the referenced NuGet packages or assembly references, recompile, and redeploy dependent applications. Refer to the Telerik Security Advisory for CVE-2024-10012 for vendor guidance.

Workarounds

Avoid deserializing data from untrusted sources within affected applications until the patched version is deployed
Replace legacy formatters such as BinaryFormatter with safer serializers like System.Text.Json or DataContractSerializer with strict type controls
Apply application allowlisting to prevent WPF hosts from spawning scripting interpreters and other high-risk child processes

bash

# Verify installed Telerik UI for WPF assembly version on Windows
Get-ChildItem -Path 'C:\Program Files (x86)\Progress\Telerik UI for WPF*' -Recurse -Filter 'Telerik.Windows.Controls.dll' |
  ForEach-Object { [PSCustomObject]@{ Path = $_.FullName; Version = (Get-Item $_.FullName).VersionInfo.FileVersion } }