CVE-2026-54777Medium· 6.5▾ SunlitCoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.09%
0.09% → 0.1%
CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic. NetNamedPipe creates a shared memory object based on the listening url, then generated a unique GUID for the named pipe it will be using and saves this to the shared memory object. Then it creates the named pipe to listen for clients. This requires an attacker to race the service and create the named pipe between the service publishing the GUID to the shared memory location (which the attacker needs to read) and the service creating the named pipe itself.
Fixed in CoreWCF v1.8.1 and v1.9.1
None
CoreWCF.NetNamedPipe < 1.8.1CoreWCF.NetNamedPipe >= 1.9.0, < 1.9.1Upgrade to a patched release:
CoreWCF.NetNamedPipe 1.8.1CoreWCF.NetNamedPipe 1.9.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-23950High· 8.8node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3
CVE-2026-29518High· 7.0Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with s…
CVE-2022-21198High· 7.9Time-of-check time-of-use race condition in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2026-54228High· 7.8A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method
CVE-2024-35265High· 7.0Windows Perception Service Elevation of Privilege Vulnerability
CVE-2024-30099High· 7.0Windows Kernel Elevation of Privilege Vulnerability