Executive brief
CoreWCF is a library used to build communication services in .NET applications. A security flaw in its named pipe transport allows a local attacker to intercept private communication between different parts of a system. This could lead to the exposure of sensitive data or the manipulation of service traffic if an attacker manages to hijack the communication channel during service startup.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the CoreWCF NetNamedPipe transport. The NamedPipeListener publishes its randomly generated pipe name via shared memory before the pipe instance is actually created. Because the listener failed to use the FILE_FLAG_FIRST_PIPE_INSTANCE flag during initialization, it would silently attach to an existing pipe if an attacker claimed the name first. A local attacker with low privileges can exploit this to intercept or spoof NetNamedPipe traffic. The fix ensures the listener fails to start if the pipe name is already in use.
Affected products
- CoreWCF CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1
Timeline
- 2026-07-08: disclosed
- 2026-07-08: advisory
- 2026-06-16: patched: Fix included in version 1.8.1 release
References
- https://github.com/CoreWCF/CoreWCF/commit/8ed9c780c7c6fb22fa215c5771dee0c1e49596b7
- https://github.com/CoreWCF/CoreWCF/commit/e7d225394fd429900dcbc445dcdd53b94e964077
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1
- https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-6jj2-4q5c-x8g6