What the vulnerability does is expose a time‑of‑check time‑of‑use race condition in the way Fiddler Classic installs its HTTPS interception root certificate. The application writes the certificate to a temporary file in a writable location, then runs an elevated helper that imports the certificate from that file. If a low‑privileged user replaces the temporary file with an attacker‑supplied one before the helper runs, a malicious root certificate can be added to the machine‑wide Trusted Root Certification Authorities store. The attacker then can intercept and alter TLS traffic on the affected computer. The penetration requires the user to trigger the trust operation and approve a UAC prompt, so it is not fully automated.

This issue affects Progress Software’s Telerik Fiddler Classic for Windows, versions older than v6.0.20262.10021. No other versions or platforms are known to be vulnerable.

The CVSS score of 6.6 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not a high‑profile or widely exploited flaw. Exploitation still requires the user to initiate the certificate trust dialog and accept the elevation prompt, which limits the attacker's reach but does not eliminate it. Once the malicious root certificate is installed, the attacker can fully compromise all secure traffic on the machine.