NetNamedPipe Local Interception in CoreWCF

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: GitHub, Inc.

Description

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF NetNamedPipe transport accepts attachment to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic when an attacker races NamedPipeListener startup between shared memory GUID publication and service named pipe creation. This issue is fixed in versions 1.8.1 and 1.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-54777

Affected Vendors & Products

Vendor	Product	Version / Range
corewcf	corewcf	to 1.9.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-665	The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

Attack-Flow Graph

Executive Summary

This vulnerability exists in CoreWCF, a port of the Windows Communication Foundation to .NET Core. Specifically, in versions prior to 1.8.1 and 1.9.1, the NetNamedPipe transport allows an attacker to attach to a pre-existing named pipe instance. This happens because an attacker can race the NamedPipeListener startup process between the publication of a shared memory GUID and the creation of the service named pipe. As a result, the attacker can locally intercept NetNamedPipe traffic.

Impact Analysis

The vulnerability can lead to local interception of NetNamedPipe traffic, which means an attacker with local access could eavesdrop on or potentially manipulate communication intended for the CoreWCF service. This can compromise the confidentiality and integrity of the data being transmitted over the named pipe.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade CoreWCF to version 1.8.1 or 1.9.1, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-54777. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70