CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance
Impact
CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic. NetNamedPipe creates a shared memory object based on the listening url, then generated a unique GUID for the named pipe it will be using and saves this to the shared memory object. Then it creates the named pipe to listen for clients. This requires an attacker to race the service and create the named pipe between the service publishing the GUID to the shared memory location (which the attacker needs to read) and the service creating the named pipe itself.
Patches
Fixed in CoreWCF v1.8.1 and v1.9.1
Workarounds
None
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| .NET (NuGet) | CoreWCF.NetNamedPipe | < 1.8.1, >= 1.9.0, < 1.9.1 | 1.8.1, 1.9.1 |
References
- CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L- Weakness (CWE)
CWE-367, CWE-665- Platform
- .NET (NuGet)
- Package
CoreWCF.NetNamedPipe- Disclosed
- 19.06.2026
- Updated
- 11.10.2026 11:23
Sources and licenses
OSV / GitHub Advisory Database - GHSA-6jj2-4q5c-x8g6 - CC BY 4.0
Vulnerability history: CoreWCF.NetNamedPipe
All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.