CVE-2026-54777: CoreWCF NetNamedPipe Transport Race Condition and Local Interception

Technical summary

The vulnerability exploits a Time-of-Check-Time-of-Use (TOCTOU) race condition in CoreWCF's NetNamedPipe transport initialization. When a CoreWCF service using NetNamedPipe starts, it first publishes a shared memory GUID to announce its availability, then subsequently creates the actual named pipe. During this interval, an unprivileged local user can attach to and control a pre-existing named pipe using the same name, intercepting all subsequent traffic intended for the legitimate service. The attack leverages CWE-367 (Time-of-Check-Time-of-Use) and CWE-665 (Improper Initialization), allowing both confidentiality and integrity compromise of Named Pipe communications. The issue affects CoreWCF versions prior to 1.8.1 and 1.9.1.

Business impact

Organizations relying on CoreWCF services with NetNamedPipe transport for inter-process communication on Windows systems face exposure to local data theft and tampering. Any service processing sensitive data—configuration, credentials, or business information—over Named Pipes can have that data exfiltrated or modified by a local attacker. While the attack requires local access, many threat scenarios involve compromised or malicious user accounts, containers, or co-tenant workloads. The impact extends to both confidentiality and integrity, potentially enabling lateral movement, credential harvesting, or poisoning of service-to-service communications. Services without Named Pipe exposure or using alternative transports remain unaffected.

Affected systems

CoreWCF versions before 1.8.1 and 1.9.1 are affected when configured to use NetNamedPipe transport. This primarily impacts .NET Core and .NET Framework 4.6.1+ applications on Windows that have adopted CoreWCF as a replacement for or supplement to the legacy WCF stack. The vulnerability is local-only; remote exploitation is not possible. Impact is limited to systems where: (1) CoreWCF services use NetNamedPipe binding, (2) untrusted or semi-trusted users have local access, and (3) the service handles sensitive data. Microservices architectures, containerized environments, and multi-tenant systems on Windows are at higher risk due to proximity of potential attackers.

Exploitability

The attack requires local code execution privileges and relies on precise timing to win a race condition. While execution is not guaranteed on the first attempt—the attacker must trigger or monitor service startup—the race window can be extended through repeated service restarts or by monitoring for startup events. An attacker with local user privileges (non-administrative) can execute this attack, making it relevant in scenarios involving compromised service accounts, container escape, or lateral movement within a system. However, the medium CVSS score (6.5) reflects the local-only requirement and the need for inter-process communication over Named Pipes; the attack surface is not universally exposed.

Remediation

Upgrade CoreWCF to version 1.8.1 or 1.9.1 (or later), which resolve the TOCTOU race condition by securing the initialization sequence of NetNamedPipe transport. Organizations must verify the version in use, update their NuGet package references, and redeploy affected services. For environments unable to patch immediately, mitigations include: (1) restricting local user access where possible, (2) disabling NetNamedPipe transport and switching to alternative transports (HTTP, Named Pipes with added access controls), (3) running services in isolated security contexts or containers with minimal local user presence, and (4) monitoring for suspicious Named Pipe creation attempts.

Patch guidance

Patch as soon as operationally feasible by updating the CoreWCF NuGet package to 1.8.1, 1.9.1, or any subsequent release. Verify the update through your project file (.csproj) or package management dashboard to confirm the patched version is installed. After patching, rebuild and redeploy affected services. For organizations managing multiple CoreWCF services, coordinate updates to avoid service interruptions. Since the vulnerability is local-only, there is no emergency requirement for out-of-band patching, but prioritize services handling sensitive data or those exposed to untrusted users. Test the patched version in a staging environment to ensure compatibility with custom transport bindings or security configurations.

Detection guidance

Monitor for suspicious Named Pipe creation attempts, particularly around the startup of CoreWCF services. Windows Event Tracing and Sysmon can capture Named Pipe creation events; look for unexpected pipe names or creation from unexpected user contexts. Additionally, audit local user privilege escalation attempts and process injection into service processes. Correlate Named Pipe creation events with CoreWCF service startup logs to identify anomalies. Security Information and Event Management (SIEM) rules should trigger on rapid successive Named Pipe creation failures or attempts to access pipes during known service startup windows. Inventory all CoreWCF deployments and their transport bindings to identify exposure; services using HTTP or other transports are not vulnerable.

Why prioritize this

While the CVSS score is medium (6.5), the combination of data confidentiality and integrity impact, coupled with the prevalence of Named Pipe communication in Windows microservices, warrants near-term patching for most organizations. The local-only requirement reduces urgency compared to remote vulnerabilities, but organizations with multi-tenant or untrusted-user environments should prioritize this higher. Services handling credentials, encryption keys, or sensitive business logic are the highest priority. The race condition also makes the attack non-deterministic, lowering real-world exploitation likelihood unless an attacker can maintain local persistence or monitor for service restarts.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects: local attack vector (not remotely exploitable), high complexity due to the race condition timing requirement, low privileges required (local user), no special user interaction, and impact spanning both confidentiality (high) and integrity (high) with low availability impact. The score appropriately weights the exploit complexity against the sensitivity of data potentially exposed. Organizations with high-value inter-process communication or complex microservice topologies may perceive elevated risk, justifying internal risk adjustments upward.

Frequently asked questions