Moderate severityNVD Advisory· Published Jun 19, 2026· Updated Jun 19, 2026
CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
CVE-2026-54778
Description
Impact
Race condition in POSIX peer identity resolution may attribute one connection’s identity to another (getpwuid/getgrgid non-reentrant) and may crash the host process under contention.
Patches
Fixed in CoreWCF v1.8.1 and v1.9.1
Workarounds
Restrict UDS filesystem permissions so that only trusted local users can connect to the socket path. The race still exists but the attacker pool is constrained.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
CoreWCF.UnixDomainSocketNuGet | < 1.8.1 | 1.8.1 |
CoreWCF.UnixDomainSocketNuGet | >= 1.9.0, < 1.9.1 | 1.9.1 |
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
1- CoreWCF: 13 CVEs Disclosed in a Single Day — Critical SAML Bypass and WS-Security FlawsVypr Intelligence · Jun 19, 2026