Progress security advisory (AV26-999)

Progress Telerik Fiddler Classic for Windows before version 6.0.20262.10021 does not adequately verify the integrity of external helper tools it launches. Before running a helper, it only checks that the file has a valid Authenticode signature whose certificate subject matches a broad allow list of publisher name fragments, instead of confirming it is the specific executable shipped with that product version. A local attacker with low privileges can replace a helper with any other validly signed binary from an allow-listed publisher so that, when a user starts the tool and approves the elevation prompt without noticing it names a different executable, the substitute runs—including as Administrator for tools that request elevation—yielding privilege escalation and unintended code execution. Windows users of affected Fiddler Classic builds are impacted. It is not listed in CISA KEV, and no public proof-of-concept is known.