Progress Telerik Fiddler Classic prior 6.0.20262.10021 Integrity Check integrity check

Summaryinfo

A vulnerability was found in Progress Telerik Fiddler Classic. It has been classified as problematic. The impacted element is an unknown function of the component Integrity Check. Performing a manipulation results in integrity check. This vulnerability is reported as CVE-2026-77805. The attack requires a local approach. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Progress Telerik Fiddler Classic. This affects an unknown code block of the component Integrity Check. The manipulation with an unknown input leads to a integrity check vulnerability. CWE is classifying the issue as CWE-354. The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode signature whose certificate subject name matches a broad allow list of publisher name fragments, rather than verifying that the file is the specific executable shipped with that version of the product. A local threat actor with low privileges who replaces one of these helper executables with any other validly signed binary from an allow-listed publisher can cause the substituted binary to be executed by the application, including with Administrator privileges for the tools that request elevation, resulting in privilege escalation and execution of unintended code. Successful exploitation requires the user to launch the affected external tool and to approve the elevation prompt without noticing that it refers to a different executable.

It is possible to read the advisory at docs.telerik.com. This vulnerability is uniquely identified as CVE-2026-77805 since 08/21/2026. The exploitability is told to be easy. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 6.0.20262.10021 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Progress

Name

• Telerik Fiddler Classic

License

• commercial

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion