CVE-2026-54777

MEDIUM6.5

CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance

Published Jul 8, 2026

Modified 2 weeks ago

Details

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF NetNamedPipe transport accepts attachment to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic when an attacker races NamedPipeListener startup between shared memory GUID publication and service named pipe creation. This issue is fixed in versions 1.8.1 and 1.9.1.

References

WEB

https://github.com/CoreWCF/CoreWCF/commit/8ed9c780c7c6fb22fa215c5771dee0c1e49596b7

WEB

https://github.com/CoreWCF/CoreWCF/commit/e7d225394fd429900dcbc445dcdd53b94e964077

WEB

https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1

WEB

https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1

WEB

https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-6jj2-4q5c-x8g6

ADVISORY