CVE-2026-77804: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition in Progress Software Progress® Telerik® Fiddler® Classic

This vulnerability involves a TOCTOU race condition in the certificate installation process of Progress® Telerik® Fiddler® Classic. The application writes the HTTPS interception root certificate to a temporary file in a user-writable location, then calls an elevated TrustCert helper to import it. A local low-privilege attacker can replace this temporary file between creation and import, causing an attacker-supplied root certificate to be installed in the Local Computer Trusted Root Certification Authorities store. This enables interception and modification of TLS traffic on the affected machine. Successful exploitation requires user interaction to initiate the certificate trust operation and approve the elevation prompt.

If exploited, this vulnerability allows a local attacker with low privileges to install a malicious root certificate in the trusted root store, enabling interception and modification of TLS-protected communications on the affected system. This compromises confidentiality and integrity of secure communications. However, exploitation requires user initiation and consent to an elevation prompt, limiting the attack vector.

A fix is available in Progress® Telerik® Fiddler® Classic version 6.0.20262.10021 and later. Users should upgrade to this version or newer to remediate the vulnerability. Until patched, users should exercise caution when initiating certificate trust operations and approving elevation prompts. Patch status is not explicitly confirmed in vendor advisory content; verify with Progress Software for current remediation guidance.