GroupDocs.Annotation for .NET 26.10 – October 2026 Release Highlights

We’re pleased to announce GroupDocs.Annotation for .NET 26.10, released in October 2026. This is a security-focused release: documents no longer pull in remote images, style sheets or linked files on their own, and new LoadOptions members let you decide exactly what may be loaded. The release also upgrades the underlying document engines, updates a vulnerable dependency and fixes several issues.

What’s new in this release

External resources are no longer loaded by default

A document can reference resources outside itself: an <img src="https://..."> in an HTML page or an e-mail body, a linked picture in a Word document, a remote style sheet or an external workbook link. Until now, opening, previewing or saving such a document made GroupDocs.Annotation request those resources from the network or a file share.

On a server that processes untrusted documents, this is a server-side request forgery (SSRF) risk: a document could make the server call internal addresses, and a UNC path could leak the Windows credentials of the process.

Starting with 26.10, external resources are skipped by default for Word-processing, HTML, e-mail, presentation and spreadsheet documents:

• No requests. No network or file-share request is made for resources referenced by the document, in any operation: Get, Add, Save, GeneratePreview and GetDocumentInfo.
• Empty placeholders. A skipped image is rendered as a transparent placeholder, and the original link is kept in the saved document.
• Embedded content still works. cid: parts of an e-mail, data: URIs and embedded pictures are always loaded.
• Image annotations are not affected. ImageAnnotation.ImagePath is still loaded from a URL.

This is a behaviour change. If your documents rely on remote images or style sheets being rendered, allow them explicitly with the new LoadOptions members:

Allow trusted hosts only (recommended):

LoadOptions loadOptions = new LoadOptions
{
    // SkipExternalResources stays true (the default)
    WhitelistedResources = { "cdn.example.com", "https://intranet.example.com/images/" }
};

using (Annotator annotator = new Annotator("input.html", loadOptions))
{
    annotator.Save("output.html"); // only images from the two whitelisted locations are loaded
}

Inspect, allow or substitute each resource with a handler:

class AuditingResourceHandler : ExternalResourceHandler
{
    public override void OnLoading(ExternalResourceLoadingArgs args)
    {
        Console.WriteLine($"{args.Uri}: {(args.Skipped ? "skipped" : "loaded")}");

        // serve a local copy instead of going to the network
        if (args.Uri == "https://example.com/logo.png")
            args.Data = File.ReadAllBytes("logo.png");
    }
}

Upgraded document engines

The bundled word-processing, spreadsheet, presentation, PDF, diagram, e-mail, imaging, CAD and graphics rendering engines are updated to their October 2026 releases. Regenerated documents and page previews may differ slightly at the byte or pixel level while remaining visually equivalent.

For .NET 6 and .NET 8 projects, the runtime packages now depend on SkiaSharp 4.152.1. If your project references SkiaSharp 3.x directly, update it to 4.x.

Security update

The document engines bring in System.Security.Cryptography.Pkcs 8.0.0 or 8.0.1, which are affected by CVE-2026-84008 and CVE-2026-70162. GroupDocs.Annotation now references the patched 8.0.2 on every target framework. No code changes are required.

Fixes

• EML from a stream. An EML message starting with MIME-Version: 1.0 was detected as an MHT archive, and opening it from a stream threw FileTypeNotSupportedException. Such messages now open the same way from a stream and from a file, and MHT files are now supported as e-mail documents.
• Older documents on .NET 8. Documents annotated by versions before 26.6 failed to open on .NET 8 with NotSupportedException. They now open: the legacy annotations are skipped with a log warning, and new annotations can be added and saved. A related issue with re-saved presentations (PPTX) whose annotations could not be read back is fixed on all frameworks.
• PDF rotation by 90 degrees. Rotating a PDF page with Annotator.Rotation worked for 180 and 270 degrees, but a 90-degree rotation was lost on save. It is now kept for every angle:

using (Annotator annotator = new Annotator("input.pdf"))
{
    annotator.ProcessPages = 1;                 // the page to rotate
    annotator.Rotation = RotationDocument.on90; // previously ignored
    annotator.Save("output.pdf");
}

Public API changes

The release adds the following members:

• LoadOptions.SkipExternalResources
• LoadOptions.WhitelistedResources
• LoadOptions.ExternalResourceHandler
• ExternalResourceHandler class
• ExternalResourceLoadingArgs class

No public members were removed or changed.

How to get the update

NuGet

Install or upgrade to GroupDocs.Annotation 26.10.0 using NuGet. The package automatically resolves the runtime package for your target framework (.NET Framework 4.6.2, .NET 6 or .NET 8):

dotnet add package GroupDocs.Annotation --version 26.10.0

Direct download

Download the release from the GroupDocs.Annotation for .NET 26.10 page.

Resources

• Full Release Notes
• Documentation
• API Reference
• Examples on GitHub
• Free Support Forum