CVE-2026-54777
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF NetNamedPipe transport accepts attachment to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic when an attacker races NamedPipeListener startup between shared memory GUID publication and service named pipe creation. This issue is fixed in versions 1.8.1 and 1.9.1.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
- EPSS probability
- 0.12%
- CWE
- CWE-367, CWE-665
- Published
- 2026-07-08
- Last modified
- 2026-07-10
Affected products
- CoreWCF CoreWCF
- CoreWCF CoreWCF
Weakness type
Related vulnerabilities
- CVE-2026-88924 — Gvfs: gvfs-admin socket ownership race permits local root
- CVE-2026-87996 — Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
- CVE-2026-79968 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-79730 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-87523 — Race condition in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...
- CVE-2026-87457 — Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local...
- CVE-2026-87433 — Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had...
- CVE-2026-87554 — Race condition in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local...