Progress Telerik Fiddler Classic for Windows releases prior to v6.0.20262.10021 perform an inadequate authenticity check on external helper tools. The product only verifies that the file has a valid Authenticode signature from an allow‑listed publisher rather than confirming that it is the exact executable bundled with that version. A local user with minimal privileges can replace a helper binary with another signed from an allowed publisher and trigger its execution. If the tool requests elevation, the user may approve the prompt, causing the substituted binary to run with Administrator rights, which leads to privilege escalation and arbitrary code execution.

The vulnerability impacts Progress Software’s Fiddler Classic for Windows. Versions earlier than 6.0.20262.10021 are affected. No other products or versions are listed.

The CVSS score of 7.9 indicates a high severity vulnerability. EPSS data is unavailable, so the current likelihood of exploitation cannot be quantified, but because the flaw only requires local elevation approval, a low‑privilege user can exploit it without advanced skills. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it by replacing a helper executable with any signed binary from an allow‑listed publisher and convincing the user to accept the elevation prompt. Successful exploitation leads to execution of the malicious code with administrator privileges.