CVE-2026-54777CWE-367CWE-665

CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance

Medium · published July 8, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
1.6
In the wild
Unconfirmed
What it is

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF NetNamedPipe transport accepts attachment to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic when an attacker races NamedPipeListener startup between shared memory GUID publication and service named pipe creation. This issue is fixed in versions 1.8.1 and 1.9.1.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00117 · 1.6th percentile
Weaknesses
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition; CWE-665 · Improper Initialization
Published
2026-07-08T22:01Z
EPSS history
Timeline
  • 08 JUL 22:01Z
    CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance
    cvelistv5