CoreWCF implements the service side of Windows Communication Foundation on .NET Core. Before versions 1.8.1 and 1.9.1 the NetNamedPipe transport allowed a pre‑existing named pipe instance to be attached, which lets a local attacker race the NamedPipeListener startup between the shared‑memory GUID publication and service pipe creation. This race enables the attacker to attach to the pipe and intercept NetNamedPipe traffic, potentially exposing confidential data. The vulnerability is fixed in releases 1.8.1 and 1.9.1.

The CoreWCF service, prior to versions 1.8.1 and 1.9.1, is affected. Administrators should upgrade to at least 1.8.1 or 1.9.1 to remove the vulnerability.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of < 1% indicates a very low exploitation probability and it is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. The attack vector remains local; a local process can manipulate the named pipe naming process to observe traffic. Until the patch is applied, the risk of confidential data leakage remains for systems that expose CoreWCF services through NetNamedPipe.