# CVE-2026-54777: CoreWCF NetNamedPipe race condition in NamedPipeListener

Source: https://junglewise.ai/threats/cve-2026-54777-corewcf-netnamedpipe-race-condition-in-namedpipelistener  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-54777 · Severity: medium · CVSS 6.5 · Published 2026-07-08

CoreWCF is a library used to build communication services in .NET applications. A security flaw in its named pipe transport allows a local attacker to intercept private communication between different parts of a system. This could lead to the exposure of sensitive data or the manipulation of service traffic if an attacker manages to hijack the communication channel during service startup.

Technologies: [CoreWCF](https://junglewise.ai/threats/technologies/corewcf). Vendors: [CoreWCF](https://junglewise.ai/threats/vendors/corewcf), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-54777 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54777 being exploited in the wild.

**How severe is CVE-2026-54777?** Medium severity, with a CVSS score of 6.5, published 8 July 2026.

**Which products and versions are affected?** CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1; CoreWCF.NetNamedPipe (NuGet) ECOSYSTEM:introduced=0,fixed=1.8.1.

**Is there a fix for CVE-2026-54777?** Yes. CoreWCF.NetNamedPipe (NuGet): upgrade to 1.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54777 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-54777?** Check whether you run CoreWCF or CoreWCF.NetNamedPipe (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- CoreWCF.NetNamedPipe (NuGet): upgrade to 1.8.1 or later

  ```sh
  dotnet add package CoreWCF.NetNamedPipe --version 1.8.1
  ```


## Technical details

A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the CoreWCF NetNamedPipe transport. The NamedPipeListener publishes its randomly generated pipe name via shared memory before the pipe instance is actually created. Because the listener failed to use the FILE_FLAG_FIRST_PIPE_INSTANCE flag during initialization, it would silently attach to an existing pipe if an attacker claimed the name first. A local attacker with low privileges can exploit this to intercept or spoof NetNamedPipe traffic. The fix ensures the listener fails to start if the pipe name is already in use.

## Affected products

- CoreWCF CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1

## Identifiers

- CVE-2026-54777
- GHSA-6jj2-4q5c-x8g6

## Timeline

- 2026-07-08: disclosed
- 2026-07-08: advisory
- 2026-06-16: patched: Fix included in version 1.8.1 release

## References

- [https://github.com/CoreWCF/CoreWCF/commit/8ed9c780c7c6fb22fa215c5771dee0c1e49596b7](https://github.com/CoreWCF/CoreWCF/commit/8ed9c780c7c6fb22fa215c5771dee0c1e49596b7)
- [https://github.com/CoreWCF/CoreWCF/commit/e7d225394fd429900dcbc445dcdd53b94e964077](https://github.com/CoreWCF/CoreWCF/commit/e7d225394fd429900dcbc445dcdd53b94e964077)
- [https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1](https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1)
- [https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1](https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1)
- [https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-6jj2-4q5c-x8g6](https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-6jj2-4q5c-x8g6)

## Related threats

- [CoreWCF cleartext proof key exposure in SPNEGO negotiation](https://junglewise.ai/threats/cve-2026-54784-corewcf-cleartext-proof-key-exposure-in-spnego-negotiation)
- [CoreWCF signature verification bypass in WS-Security](https://junglewise.ai/threats/cve-2026-54783-corewcf-signature-verification-bypass-in-ws-security)
- [CoreWCF authentication bypass in SAML token validation](https://junglewise.ai/threats/cve-2026-54782-corewcf-authentication-bypass-in-saml-token-validation)
- [CoreWCF improper authentication in SAML SamlSecurityTokenHandler](https://junglewise.ai/threats/cve-2026-54781-corewcf-improper-authentication-in-saml-samlsecuritytokenhandler)
- [CoreWCF algorithm downgrade in WS-Security receive pipeline](https://junglewise.ai/threats/cve-2026-54780-corewcf-algorithm-downgrade-in-ws-security-receive-pipeline)