← Back to search

CVE-2026-77805

7.9 HIGH

Published 2026-10-05 · Updated 2026-10-06

AI risk analysis

Summary
The flaw in n/a versions of Progress® Telerik® Fiddler® Classic for Windows allows a local attacker with low privileges to replace a helper tool with a maliciously crafted binary, leading to privilege escalation and execution of unintended code.
Exploitability
Exploitation requires local access and the ability to replace a specific helper tool, making it moderately hard to exploit.
Blast radius
If exploited, the impact is significant as it can lead to privilege escalation and execution of arbitrary code, potentially compromising the entire system.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade to v6.0.20262.10021 or later.
rceprivilege-escalationlocal-attack

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode signature whose certificate subject name matches a broad allow list of publisher name fragments, rather than verifying that the file is the specific executable shipped with that version of the product. A local threat actor with low privileges who replaces one of these helper executables with any other validly signed binary from an allow-listed publisher can cause the substituted binary to be executed by the application, including with Administrator privileges for the tools that request elevation, resulting in privilege escalation and execution of unintended code. Successful exploitation requires the user to launch the affected external tool and to approve the elevation prompt without noticing that it refers to a different executable.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weaknesses

CWE-347

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.