Local Interception Vulnerability in CoreWCF NetNamedPipe Transport

CVE-2026-54777

What is CVE-2026-54777?

CoreWCF, which ports Windows Communication Foundation (WCF) to .NET Core, suffers from a vulnerability in its NetNamedPipe transport. This flaw allows for local interception of NetNamedPipe traffic through a race condition that occurs during the NamedPipeListener startup. Specifically, an attacker could exploit the timing between the publication of a shared memory GUID and the creation of the service's named pipe instance, enabling unauthorized access to sensitive data. The vulnerability is addressed in updates 1.8.1 and 1.9.1, which reinforce security measures to prevent this type of attack.

References