---
id: CVE-2026-54777
title: >-
  CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe
  instance
summary: >-
  CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe
  instance
severity: medium
cvss: 6.5
cwe:
  - CWE-367
  - CWE-665
vendor: CoreWCF
product: CoreWCF.NetNamedPipe
ecosystem: nuget
affected:
  - CoreWCF.NetNamedPipe < 1.8.1
  - 'CoreWCF.NetNamedPipe >= 1.9.0, < 1.9.1'
patched:
  - CoreWCF.NetNamedPipe 1.8.1
  - CoreWCF.NetNamedPipe 1.9.1
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-6jj2-4q5c-x8g6'
references:
  - url: 'https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-6jj2-4q5c-x8g6'
  - url: 'https://github.com/advisories/GHSA-6jj2-4q5c-x8g6'
tags:
  - ghsa
  - nuget
ingestedAt: '2026-06-22T13:35:24.432Z'
epss: 0.00117
epssPercentile: 0.01464
---

## Overview

### Impact
CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic. NetNamedPipe creates a shared memory object based on the listening url, then generated a unique GUID for the named pipe it will be using and saves this to the shared memory object. Then it creates the named pipe to listen for clients. This requires an attacker to race the service and create the named pipe between the service publishing the GUID to the shared memory location (which the attacker needs to read) and the service creating the named pipe itself.

### Patches
Fixed in CoreWCF v1.8.1 and v1.9.1

### Workarounds
None

## Affected packages

- `CoreWCF.NetNamedPipe < 1.8.1`
- `CoreWCF.NetNamedPipe >= 1.9.0, < 1.9.1`

## Remediation

Upgrade to a patched release:

- `CoreWCF.NetNamedPipe 1.8.1`
- `CoreWCF.NetNamedPipe 1.9.1`