Telerik Fiddler Classic EUVD-2026-92428

Exploitation requires an existing low-privilege local account on a host running Fiddler Classic prior to v6.0.20262.10021, plus the ability to overwrite one of the application's external helper executables on disk. The substituted file must itself carry a valid Authenticode signature whose certificate subject matches one of the allow-listed publisher name fragments (the integrity check validates publisher fragments, not the specific shipped binary). Critically, exploitation is gated on user interaction: the victim must launch the affected external tool AND approve the Administrator elevation prompt without noticing it references a different executable - this UI:R requirement and the need for a pre-existing local foothold are the primary factors limiting real-world exploitation. It is not remotely or unauthenticated exploitable.

This is a moderate, locally-exploitable privilege-escalation flaw (CVSS 7.9) rather than a drop-everything priority. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N confirms the attacker must already have low-privilege local access (PR:L) and depends on user interaction (UI:R) - specifically the victim launching the helper tool and approving an elevation prompt - so this is not remotely exploitable and not automatable. The scope change (S:C) and C:H/I:H reflect that successful exploitation yields Administrator-level code execution, which is a meaningful outcome, but the chain of preconditions (local foothold + user error at the UAC prompt) sharply limits real-world mass exploitation. No EPSS score, CISA KEV listing, or public POC is present in the provided data, consistent with no public exploit identified at time of analysis; this reinforces that the flaw is a credible defense-in-depth weakness but not an actively-weaponized threat. The signals are internally consistent - there is no conflict between the local CVSS vector and the description, both of which describe a local, interaction-dependent attack.

An attacker with an existing low-privileged account on a Windows workstation where Fiddler Classic is installed replaces one of the application's external helper executables with a different, validly-signed binary from any allow-listed publisher. When the legitimate user later launches that helper tool and clicks through the elevation prompt without noticing it references a different executable, the attacker's substituted binary runs with Administrator privileges. No public exploit code is identified in the provided data, so exploitation would currently require custom tooling.