CVE-2026-77804 in Telerik Fiddler Classic
Summary
by MITRE • 10/05/2026
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use (TOCTOU) race condition exists in the installation of the HTTPS interception root certificate into the Local Computer certificate store. Fiddler writes the certificate to a temporary file in a user-writable location and then launches the external TrustCert helper application, which elevates and imports the certificate from that file. A local threat actor with low privileges who replaces the temporary file between the time it is written and the time the elevated helper reads it can cause an attacker-supplied root certificate to be installed in the Local Computer Trusted Root Certification Authorities store, enabling subsequent interception and modification of TLS-protected traffic on the machine. Successful exploitation requires the user to initiate the certificate trust operation and approve the elevation prompt.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in Progress Telerik Fiddler Classic for Windows versions prior to v6.0.20262.10021 represents a critical security flaw rooted in improper handling of temporary files during privilege escalation operations. This specific issue is classified as a Time-of-Check-Time-of-Use, or TOCTOU, race condition. The core technical failure occurs within the mechanism used to install the HTTPS interception root certificate into the Local Computer certificate store on Windows systems. To perform this installation, Fiddler first writes the target certificate data to a temporary file located in a directory that is writable by standard user accounts. Subsequently, it launches an external helper application named TrustCert.exe with elevated privileges to read from and import this certificate file into the system-wide trusted root store. The fundamental flaw lies in the lack of atomicity between these two steps; there is no secure validation or locking mechanism ensuring that the temporary file remains unchanged during the interval between its creation by the low-privileged process and its consumption by the high-privileged helper application.
From a technical perspective, this architecture creates a predictable window of opportunity for exploitation. Because the intermediate storage location allows write access to any local user with an active session on the machine, a malicious actor can monitor or predict the path of the temporary file generated during the certificate installation process. By employing race condition techniques, such as rapid file replacement using high-speed loops or symbolic link manipulation if applicable within the specific OS version constraints, an attacker can swap the legitimate Fiddler root certificate with their own crafted malicious root certificate before the elevated TrustCert helper reads it. When the privileged application proceeds to import the file contents into the Local Computer Trusted Root Certification Authorities store, it inadvertently trusts the attacker-supplied certificate rather than the intended one. This action effectively grants the attacker a position of trust within the operating system's security boundary without requiring direct administrative credentials for that specific operation, relying instead on the user initiating the Fiddler configuration and approving the elevation prompt.
The operational impact of successfully exploiting this vulnerability is severe, primarily concerning the integrity and confidentiality of network communications processed by the host machine. Once a malicious root certificate resides in the Local Computer Trusted Root Certification Authorities store, it becomes trusted by all applications running on that system, including web browsers like Chrome, Firefox, or Edge, as well as other TLS-aware software. This allows an attacker to perform man-in-the-middle attacks against any HTTPS traffic originating from or destined for this machine. The attacker can intercept, decrypt, inspect, and modify sensitive data such as login credentials, session tokens, financial information, and proprietary communications without triggering certificate warnings in standard browser configurations. Since the malicious root is trusted by the operating system itself, bypassing security controls becomes trivial for any subsequent network interaction involving public or private HTTPS services that validate certificates against this compromised trust store.
This vulnerability maps directly to CWE-367, which defines Time-of-check-Time-of-use (TOCTOU) race conditions, specifically highlighting the failure to maintain atomicity in file operations across privilege boundaries. It also aligns with ATT&CK technique T1059.004, Command and Scripting Interpreter: PowerShell or similar scripting mechanisms often used to facilitate such races, although here it is a native application logic flaw rather than script execution per se. Furthermore, the outcome of installing an unauthorized root certificate relates to CWE-295, Improper Certificate Validation, as the system fails to verify that the source of the trust anchor has not been tampered with during transit between user and system contexts. The requirement for a local attacker suggests this is primarily relevant in multi-user environments or shared workstations where one low-privilege account can influence another process running under different privileges.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is to upgrade Progress Telerik Fiddler Classic to version v6.0.20262.10021 or later, where the vendor has presumably implemented secure temporary file handling practices such as using non-writable system directories for intermediate files, employing atomic rename operations, or utilizing cryptographic signing of the certificate payload prior to elevation rather than relying on raw file content from a shared location. For organizations unable to upgrade immediately, restricting write permissions to common temp folders via Group Policy can reduce the attack surface by preventing low-privilege users from creating arbitrary temporary files in those locations. Additionally, implementing strict application control policies that prevent unsigned or unapproved helper applications like TrustCert.exe from executing with elevated privileges would block this specific exploitation path even if a TOCTOU condition exists. Regular auditing of installed root certificates and monitoring for unexpected additions to the Local Computer store can also aid in early detection of such compromises.