CVE-2026-54777: CoreWCF Race Condition Vulnerability

CVE-2026-54777 Overview

CVE-2026-54777 is a race condition vulnerability in CoreWCF, the .NET Core port of the service side of Windows Communication Foundation (WCF). Versions prior to 1.8.1 and 1.9.1 allow the NetNamedPipe transport to attach to a pre-existing named pipe instance during NamedPipeListener startup. A local attacker who wins the race between shared memory GUID publication and service named pipe creation can intercept NetNamedPipe traffic. The issue is tracked as [CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition] and is resolved in CoreWCF 1.8.1 and 1.9.1.

Critical Impact
A local attacker can intercept NetNamedPipe traffic between clients and the CoreWCF service, exposing confidential message content and enabling tampering with in-flight requests.

Affected Products

CoreWCF versions prior to 1.8.1
CoreWCF 1.9.0 and earlier 1.9.x releases prior to 1.9.1
.NET services using the CoreWCF.NetNamedPipe transport

Discovery Timeline

2026-07-08 - CVE-2026-54777 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-54777

Vulnerability Analysis

CoreWCF exposes services over the net.pipe transport by publishing a GUID in a shared memory section that clients use to locate the underlying named pipe. During NamedPipeListener startup, the listener publishes the shared memory mapping before it confirms exclusive ownership of the target named pipe instance. If an attacker creates the named pipe with the expected name first, the listener attaches to that pre-existing instance rather than creating a new one. The attacker becomes the effective server endpoint for all inbound NetNamedPipe connections and can read or modify serialized WCF messages.

Root Cause

The root cause is a TOCTOU race in NamedPipeListener.cs. The _firstConnection flag defaulted to false, so the first accept path did not enforce that the listener itself created the pipe instance. Combined with the ordering of shared memory GUID publication before pipe creation, this allowed a concurrent local process to plant a pipe with the anticipated name and hijack the transport.

Attack Vector

Exploitation requires local code execution on the host running the CoreWCF service and low privileges. The attacker enumerates or predicts the target pipe name, opens a named pipe with that name, and races the CoreWCF listener during service startup or restart. Once the listener attaches, the attacker relays or manipulates traffic, breaking confidentiality and integrity of the NetNamedPipe channel. Attack complexity is high because it depends on winning a startup race window.

text

         private PipeSharedMemory _sharedMemory;
         private Task[] _tasks;
         private CancellationTokenSource _acceptPumpCancellationTokenSource;
-        private bool _firstConnection;
+        private bool _firstConnection = true;
         private ILogger<FramingConnection> _framingConnectionLogger;
         private TransportConnectionManager _transportConnectionManager;
         private readonly PipeOptions _inputOptions;

Source: CoreWCF Commit 8ed9c78 and CoreWCF Commit e7d2253. The patch initializes _firstConnection = true so the listener refuses to attach to a pre-existing NetNamedPipe instance on startup and instead requires that it created the pipe itself.

Detection Methods for CVE-2026-54777

Indicators of Compromise

Unexpected processes owning named pipes whose names match a CoreWCF service endpoint before the service starts.
Multiple handles to the same \\.\pipe\<name> from processes other than the CoreWCF host process.
CoreWCF services logging successful startup but connecting to a pipe instance they did not create.
Local user processes creating named pipes shortly before or during CoreWCF service restarts.

Detection Strategies

Inventory installed CoreWCF assemblies and flag versions below 1.8.1 or between 1.9.0 and 1.9.1 on Windows and Linux hosts.
Monitor named pipe creation events (Sysmon Event ID 17/18) and correlate creator process identity against the expected CoreWCF service account.
Alert on pipe name collisions where a non-service process holds a pipe matching a known WCF endpoint namespace.

Monitoring Recommendations

Enable Sysmon named pipe logging on servers hosting CoreWCF workloads and forward events to a central log platform.
Track service restart events for CoreWCF hosts and correlate with local process creation in the seconds preceding startup.
Review authentication and message logs on CoreWCF services for unexpected disconnects, protocol errors, or client identity anomalies indicative of a proxied connection.

How to Mitigate CVE-2026-54777

Immediate Actions Required

Upgrade CoreWCF to 1.8.1 or 1.9.1 immediately on all hosts using the NetNamedPipe transport.
Restrict interactive and service logon rights on servers running CoreWCF to reduce the pool of local users that can race the listener.
Restart CoreWCF services only after confirming no unauthorized process holds the target pipe name.

Patch Information

The fix is shipped in CoreWCF Release v1.8.1 and CoreWCF Release v1.9.1. Details are documented in GitHub Security Advisory GHSA-6jj2-4q5c-x8g6. The patch sets _firstConnection = true in NamedPipeListener.cs so the listener refuses to attach to an existing pipe instance during startup.

Workarounds

Where patching is delayed, disable the NetNamedPipe transport and use an alternate binding such as NetTcp with transport security.
Constrain the set of local principals allowed to create named pipes on hosts running CoreWCF by hardening service account isolation and removing unnecessary local accounts.
Apply application-level message security (signing and encryption) on the WCF binding so intercepted traffic remains protected even if the transport is hijacked.

bash

# Update CoreWCF package references to the patched versions
dotnet add package CoreWCF.NetNamedPipe --version 1.9.1
dotnet add package CoreWCF.Primitives --version 1.9.1

# Verify the resolved version
dotnet list package | grep CoreWCF