CVE-2026-54778: CoreWCF Unix Domain Socket Identity Confusion & DoS

Technical summary

CoreWCF's UnixDomainSocket implementation performs POSIX peer identity resolution using getpwuid() and getgrgid() functions, which are not reentrant. In multithreaded environments, concurrent calls to these functions can race and return user/group data belonging to a different process's lookup, resulting in identity confusion or heap corruption. The vulnerability combines a race condition (CWE-362) with unsafe system function usage (CWE-825), allowing an attacker with local access to trigger credential misattribution or denial of service through process termination.

Business impact

Organizations running CoreWCF-based services on Unix/Linux platforms face two operational risks: service availability degradation due to crashes under connection load, and potential security boundary violations if the identity confusion permits unauthorized access to resources that depend on correct peer identification. This is most critical in multi-tenant or privileged service scenarios where identity isolation is a security control.

Affected systems

CoreWCF versions prior to 1.8.1 and 1.9.1 are vulnerable. The flaw is specific to Unix domain socket scenarios on POSIX systems (Linux, BSD, macOS). Systems using CoreWCF for named pipe or other transport mechanisms are not affected. Applications must be running on a Unix-compatible OS and actively using UnixDomainSocket endpoints.

Exploitability

Exploitation requires local access to the system and the ability to establish concurrent connections to the vulnerable CoreWCF service. The attacker does not need elevated privileges. The attack is probabilistic—success depends on precise timing during connection setup. While not trivial to execute reliably, the barrier to initial attempts is low for any local user with network access to the service endpoint.

Remediation

Upgrade CoreWCF to version 1.8.1 or 1.9.1 or later. Organizations should verify their current CoreWCF version in project dependencies and apply updates during the next maintenance window. The fix addresses the race condition by implementing thread-safe identity resolution mechanisms.

Patch guidance

Check your project's dependency manifest (packages.config, .csproj, or package.json equivalent) for CoreWCF version. If running 1.8.0 or earlier in the 1.8.x line, update to 1.8.1. If running 1.9.0, update to 1.9.1. For systems on versions 1.7.x or earlier, consult the vendor advisory for supported upgrade paths. Testing should focus on Unix socket scenarios under load to confirm identity resolution stability post-patch.

Detection guidance

Monitor CoreWCF process logs and OS audit trails for: (1) unexpected process crashes or segmentation faults in CoreWCF services, particularly under high concurrent load; (2) failed authentication or authorization events with mismatched user identities; (3) system call tracing (strace, dtrace) of getpwuid/getgrgid patterns showing overlapping concurrent calls. IDS/IPS signatures are unlikely to detect this, as it is a timing-based local flaw rather than a network exploit.

Why prioritize this

CVSS 6.2 (Medium) reflects the combination of local-only access requirement, low user interaction, but moderate integrity and high availability impact. Prioritization should account for: your service's concurrency profile (higher load = higher risk), whether Unix domain sockets are used, and whether peer identity is a security boundary in your application architecture. Organizations with Unix-based deployments and identity-dependent access controls should treat this as higher priority.

Risk score, explained

The CVSS vector (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) assigns Medium severity due to: local attack vector only; high attack complexity (race condition requires timing precision); no privilege requirement; confidentiality and integrity impact (identity confusion); high availability impact (process crash). The score does not elevate to High because exploitation is not straightforward and requires local access combined with race condition success.

Frequently asked questions