Fiddler Classic EUVD-2026-92425

Exploitation requires: (1) local access as a low-privileged user to a Fiddler Classic (for Windows) instance that is shared by multiple users through the same proxy; (2) a victim user sending traffic through that same Fiddler instance; and (3) a non-RFC-9110-compliant origin server that honors keep-alive and tolerates multiple/conflicting Content-Length headers. The attack is a request-smuggling desync (CWE-444) caused by Fiddler framing the body on the first Content-Length while forwarding both headers verbatim, with the smuggled response surviving in Fiddler's connection pipe pool. Limiting factors: no remote/network vector (AV:L), the race/reuse dependency and the requirement for a misbehaving origin make it high-complexity (AC:H), and the attacker must already hold low-level local privileges (PR:L) on a genuinely multi-user proxy deployment - a single-user developer desktop is not meaningfully exposed. Patched in v6.0.20262.10021.

This is a genuine but comparatively low-urgency issue, and the CVSS 6.3 (Medium) rating is well-calibrated to the vendor-supplied vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. The key dampeners are AV:L (not remotely reachable - the attacker must be a local, low-privileged user sharing the same Fiddler Classic proxy instance), AC:H (success depends on winning a connection-reuse/desync race and on the origin server being non-RFC-9110-compliant and keeping the connection alive), and PR:L (some authenticated/local access already required). These offset the high C:H/I:H impact (cross-user response poisoning and disclosure of another user's responses). No EPSS score, KEV listing, or POC was provided in the intelligence, so there is no evidence of active exploitation or weaponization - exploitation status is 'no public exploit identified at time of analysis.' Net: a real defensible vulnerability in a developer debugging proxy, but not a drop-everything priority given the local vector, high complexity, and dependence on a misbehaving origin server. No signals conflict; the main gap is the absence of EPSS/KEV/POC data, which is an absence rather than a contradiction.

On a shared/multi-user Fiddler Classic instance, a low-privileged local user sends an HTTP request carrying two conflicting Content-Length headers to a non-RFC-9110-compliant, keep-alive origin server. Fiddler frames the body using only the first Content-Length and forwards both headers verbatim, so a second 'smuggled' request/response stays buffered on the pooled socket and is then served to the next user who reuses that connection, letting the attacker poison or steal other users' responses. No public POC was reported in the provided data; exploitation requires winning a connection-reuse race (AC:H).