CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to releases 1.8.1 and 1.9.1, the NetNamedPipe transport accepted attachment to a pre-existing named pipe instance, enabling local interception of NetNamedPipe traffic when an attacker races the NamedPipeListener startup between the shared memory GUID publication and the service named pipe creation. This race allows a local attacker to intercept traffic and potentially expose sensitive data. The vulnerability has been mitigated in releases 1.8.1 and 1.9.1.

The CoreWCF service, prior to versions 1.8.1 and 1.9.1, is affected. Administrators should upgrade to at least 1.8.1 or 1.9.1 to remove the vulnerability.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of < 1% indicates a very low exploitation probability and it is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. The attack vector remains local; a local process can manipulate the named pipe naming process to observe traffic. Until the patch is applied, the risk of confidential data leakage remains for systems that expose CoreWCF services through NetNamedPipe.