CVE-2026-54778

Name of the Vulnerable Software and Affected Versions CoreWCF versions prior to 1.8.1 CoreWCF versions prior to 1.9.1

Description CoreWCF UnixDomainSocket POSIX peer identity resolution utilizes non-reentrant getpwuid and getgrgid calls. This creates a race condition where concurrent connections may result in one connection's identity being incorrectly attributed to another or cause the host process to crash under contention. Non-reentrant functions are those that cannot be safely interrupted and resumed without risking data corruption or inconsistent states when accessed by multiple threads simultaneously.

Recommendations Update to version 1.8.1. Update to version 1.9.1. Restrict UDS filesystem permissions to ensure only trusted local users can connect to the socket path.