CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In versions prior to 1.8.1 and 1.9.1, its UnixDomainSocket transport performed POSIX peer identity resolution using non‑reentrant getpwuid and getgrgid calls. When handling multiple simultaneous connections, the flaw can cause a client’s identity to be assigned to a different session or trigger a crash of the host process. The race condition (CWE‑362) combined with unsafe POSIX calls (CWE‑825) permits identity spoofing or denial of service.

CoreWCF employs the UnixDomainSocket transport and is vulnerable in releases prior to 1.8.1 and 1.9.1. The issue is addressed by the fixes included in versions 1.8.1 and 1.9.1.

The CVSS score of 6.2 and the EPSS score of <1% along with the absence of a KEV listing suggest a low likelihood of exploitation in the wild. Nevertheless, an attacker who can open concurrent UnixDomainSocket connections to a CoreWCF service could induce identity confusion or force the service to crash, affecting confidentiality, integrity, or availability for that deployment.