What happened
RadPdfProcessing and the AI document summarization/QA features contain uncontrolled recursion, infinite-loop, algorithmic-complexity and resource-allocation failures that let an unauthenticated attacker crash or hang the host process with a crafted document (CVSS 7.5, CWE-407/674/770/789/835).
Why it matters
Document AI pipelines ingest untrusted PDFs; this turns input into a trivial unauthenticated denial-of-service against the process running summarization/QA, taking the AI feature (or the host worker) offline.
Attack vector
An unauthenticated attacker submits a crafted PDF or document text to the AI document summarization / question-answering path, triggering uncontrolled recursion, infinite loop, or excessive resource allocation that terminates or hangs the host process.
Affected systems
Progress Telerik Document Processing Libraries < 2026.3.1027
Mitigation
Upgrade to Telerik Document Processing Libraries 2026.3.1027 (see KB advisory).