CVE-2026-54778CWE-362CWE-825

CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution

Medium · published July 8, 2026

CVSS v3.1
6.2
EPSS
0%
Percentile
2.2
In the wild
Unconfirmed
What it is

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF UnixDomainSocket POSIX peer identity resolution uses non-reentrant getpwuid and getgrgid calls, allowing concurrent connections to attribute one connection's identity to another or crash the host process under contention. This issue is fixed in versions 1.8.1 and 1.9.1.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00127 · 2.2th percentile
Weaknesses
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-825 · Expired Pointer Dereference
Published
2026-07-08T22:11Z
EPSS history
Timeline
  • 08 JUL 22:11Z
    CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
    cvelistv5