CVE-2024-8316

Progress Telerik UI for WPF carries an insecure deserialization flaw that enables code execution, triggered locally when a user interacts with malicious data the component deserializes. WPF is a desktop UI framework, so the realistic scenario is a fat-client application built on Telerik processing an attacker-crafted input and running code in the user's context as a result.

Deserialization-to-RCE is a well-worn and reliable technique, but the local vector and user-interaction requirement here mean this isn't remotely sprayed — it depends on getting crafted data in front of a user of the affected desktop application. That frames it as a targeted client-side risk: dangerous where the vulnerable component is widely used, but gated by how the malicious payload reaches the user.

Our angle is dependency inventory in built software rather than server exposure. Telerik UI for WPF is a component compiled into applications, so the question is which of our desktop apps bundle it and at what version — the kind of dependency that's easy to lose track of once shipped. We prioritize rebuilding affected applications against the fixed release, since there's no server-side knob to turn when the vulnerable code ships inside the client.