CVE-2026-54778: CoreWCF race condition in UnixDomainSocket identity resolution

CVE-2026-54778 · Severity: medium · CVSS 6.2 · Published 2026-07-08

CoreWCF is a library used to build communication services in .NET applications. A flaw in how it identifies users on Linux-based systems could allow one user's identity to be incorrectly attributed to another during simultaneous connections. This could lead to unauthorized access or cause the service to crash, impacting both security and system stability.

Technologies: CoreWCF. Vendors: CoreWCF, NuGet.

Quick answers

Is CVE-2026-54778 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54778 being exploited in the wild.
How severe is CVE-2026-54778?
Medium severity, with a CVSS score of 6.2, published 8 July 2026.
Which products and versions are affected?
CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1; CoreWCF.UnixDomainSocket (NuGet) ECOSYSTEM:introduced=0,fixed=1.8.1.
Is there a fix for CVE-2026-54778?
Yes. CoreWCF.UnixDomainSocket (NuGet): upgrade to 1.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54778 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-54778?
Check whether you run CoreWCF or CoreWCF.UnixDomainSocket (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • CoreWCF.UnixDomainSocket (NuGet): upgrade to 1.8.1 or later
    dotnet add package CoreWCF.UnixDomainSocket --version 1.8.1

Technical details

A race condition exists in CoreWCF's UnixDomainSocket implementation when resolving POSIX peer identities. The library utilized non-reentrant libc functions (getpwuid and getgrgid) which return pointers to shared static buffers. Under high concurrency, these buffers could be overwritten by subsequent calls before the data was safely marshaled into managed code. This allows for identity spoofing between concurrent local connections or a process crash due to improper synchronization (CWE-362). The issue is resolved in versions 1.8.1 and 1.9.1 by migrating to the reentrant _r variants (getpwuid_r and getgrgid_r) with caller-supplied buffers.

Affected products

  • CoreWCF CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1

Identifiers

  • CVE-2026-54778
  • GHSA-q6v9-43v5-jv9q

Timeline

  • 2026-07-08: advisory
  • 2026-07-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.