CoreWCF NetNamedPipe CVE-2026-54777
MEDIUM
GHSA-6jj2-4q5c-x8g6
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Local attack vector and race condition timing requirement justify AV:L/AC:H; shared memory read access requires low privileges; full traffic interception yields C:H/I:H with minor availability disruption.
Primary rating from Vendor (https://github.com/CoreWCF/CoreWCF).
CVSS VectorVendor: https://github.com/CoreWCF/CoreWCF
Lifecycle Timeline
2DescriptionCVE.org
Impact
CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic. NetNamedPipe creates a shared memory object based on the listening url, then generated a unique GUID for the named pipe it will be using and saves this to the shared memory object. Then it creates the named pipe to listen for clients. This requires an attacker to race the service and create the named pipe between the service publishing the GUID to the shared memory location (which the attacker needs to read) and the service creating the named pipe itself.
Patches
Fixed in CoreWCF v1.8.1 and v1.9.1
Workarounds
None
AnalysisAI
Local named pipe interception in CoreWCF.NetNamedPipe allows an authenticated local attacker to hijack WCF inter-process communication by winning a TOCTOU race condition. Affected versions expose a window between GUID publication to shared memory and named pipe creation, during which an attacker can pre-create the pipe and silently intercept or manipulate all NetNamedPipe transport traffic. No public exploit or active exploitation has been identified; fixed versions 1.8.1 and 1.9.1 are available from the vendor.
Technical ContextAI
CoreWCF is the open-source .NET implementation of Windows Communication Foundation (WCF). Its NetNamedPipe transport uses Windows named pipes for local inter-process communication. The vulnerable mechanism involves two sequential, non-atomic operations: first, the service writes a generated GUID (the name of the pipe it will use) into a shared memory object keyed to the listening URL; second, it creates the named pipe using that GUID. CWE-367 (Time-of-check Time-of-use) applies because a local attacker can read the GUID from shared memory during the window after step one but before step two, then create a named pipe with that GUID themselves - causing the service's subsequent CreateNamedPipe call to attach to the attacker-controlled pipe instance. Affected packages are identified by CPE pkg:nuget/corewcf.netnamedpipe for versions prior to 1.8.1 and in the 1.9.0 series prior to 1.9.1.
RemediationAI
Vendor-released patches are available: upgrade CoreWCF.NetNamedPipe to version 1.8.1 (for applications on the 1.x stable branch) or version 1.9.1 (for applications on the 1.9.x branch). The official advisory is at https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-6jj2-4q5c-x8g6. The vendor has explicitly confirmed no workarounds exist for this vulnerability. If immediate patching is not feasible, consider migrating affected services to a different CoreWCF transport (e.g., NetTcpBinding with loopback address and strict firewall rules) as a temporary compensating control - this eliminates the named pipe attack surface but introduces network socket overhead and requires reconfiguring endpoints. Additionally, restricting OS-level permissions on shared memory objects and named pipe creation for non-service accounts can raise the privilege bar needed for exploitation, though this is a defense-in-depth measure and not a formal mitigation.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today