GHSA-6jj2-4q5c-x8g6

Source

https://github.com/advisories/GHSA-6jj2-4q5c-x8g6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-6jj2-4q5c-x8g6/GHSA-6jj2-4q5c-x8g6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6jj2-4q5c-x8g6

Aliases

CVE-2026-54777

Published

2026-06-19T20:46:55Z

Modified

2026-06-19T21:00:17.267436271Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L CVSS Calculator

Summary

CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance

Details

Impact

CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic. NetNamedPipe creates a shared memory object based on the listening url, then generated a unique GUID for the named pipe it will be using and saves this to the shared memory object. Then it creates the named pipe to listen for clients. This requires an attacker to race the service and create the named pipe between the service publishing the GUID to the shared memory location (which the attacker needs to read) and the service creating the named pipe itself.

Patches

Fixed in CoreWCF v1.8.1 and v1.9.1

Workarounds

None

Database specific

{
    "nvd_published_at": null,
    "github_reviewed_at": "2026-06-19T20:46:55Z",
    "github_reviewed": true,
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-367",
        "CWE-665"
    ]
}

References

Affected packages

NuGet / CoreWCF.NetNamedPipe

Package

Name: CoreWCF.NetNamedPipe; View open source insights on deps.dev
Purl: pkg:nuget/CoreWCF.NetNamedPipe

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.8.1

Affected versions

1.*

1.4.0-preview1

1.4.1

1.5.0-preview1

1.7.0-preview

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-6jj2-4q5c-x8g6/GHSA-6jj2-4q5c-x8g6.json"