Fiddler Classic EUVD-2026-92427

Exploitation requires: (1) the attacker already has local low-privileged code execution on the same Windows host; (2) a legitimate user must actively initiate Fiddler Classic's HTTPS-decryption root-certificate trust operation AND approve the UAC elevation prompt for the TrustCert helper; and (3) the attacker must win the TOCTOU race by replacing Fiddler's certificate file in its user-writable temp location between write and the elevated helper's read. Limiting factors that reduce real-world risk: it is local-only (no remote vector), depends on a specific one-time user-triggered workflow, needs mandatory user approval of elevation, and success is probabilistic because it hinges on timing the race window. Affects Fiddler Classic for Windows versions prior to v6.0.20262.10021.

This is a genuine but conditional local privilege-abuse flaw, not an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, base 6.6) confirms a LOCAL attack vector requiring an already-authenticated low-privileged user on the machine plus user interaction, which caps real-world urgency well below a remote/unauthenticated bug of the same impact. No EPSS score, no KEV listing, and no POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - EPSS/KEV absence here is a true information gap, not confirmation of safety. The C:H/I:H rating is well justified: a successfully planted root CA in the Local Computer Trusted Root store enables full TLS interception/modification for every user on the host. I disagree with the input AC:L: winning a time-of-check-to-time-of-use race on a temp file is not reliably reproducible and realistically warrants AC:H, which would lower the score slightly. Net: a legitimate medium-severity local issue to patch on developer/QA endpoints, but it should not be triaged alongside remotely exploitable critical CVEs.

A low-privileged user already logged onto a shared or multi-user Windows workstation monitors the user-writable temp location where Fiddler stages its root certificate. When a legitimate user initiates Fiddler's HTTPS decryption setup and approves the UAC elevation prompt, the attacker swaps the staged certificate for their own in the TOCTOU window, and the elevated TrustCert helper imports the attacker's CA into the machine-wide Trusted Root store. No public exploit code is identified at time of analysis, and the attacker must both win the race and rely on the victim approving elevation.