{"id":"CVE-2026-54778","aliases":["GHSA-q6v9-43v5-jv9q"],"url":"https://o3.security/vulnerability/CVE-2026-54778","summary":"CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution","details":"### Impact\nRace condition in POSIX peer identity resolution may attribute one connection’s identity to another (getpwuid/getgrgid non-reentrant) and may crash the host process under contention.\n\n### Patches\nFixed in CoreWCF v1.8.1 and v1.9.1\n\n### Workarounds\nRestrict UDS filesystem permissions so that only trusted local users can connect to the socket path. The race still exists but the attacker pool is constrained.","published":"2026-07-08T22:11:55.490Z","modified":"2026-10-21T02:58:35.591909545Z","cvss":{"score":6.2,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"},"epss":{"score":0.00127,"percentile":0.02722,"asOf":"2026-09-13"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"CoreWCF.UnixDomainSocket","fixedVersion":"1.8.1"},{"ecosystem":"NuGet","name":"CoreWCF.UnixDomainSocket","fixedVersion":"1.9.1"}],"fix":{"url":"https://github.com/CoreWCF/CoreWCF/commit/a3d95ea4627b818995e92c7def4c016164cacfce","label":"CoreWCF/CoreWCF@a3d95ea"},"references":[{"type":"WEB","url":"https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1"},{"type":"WEB","url":"https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54778.json"},{"type":"ADVISORY","url":"https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-q6v9-43v5-jv9q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54778"},{"type":"FIX","url":"https://github.com/CoreWCF/CoreWCF/commit/a3d95ea4627b818995e92c7def4c016164cacfce"},{"type":"FIX","url":"https://github.com/CoreWCF/CoreWCF/commit/b0acb105589b455a095ea5ff49f5191e4eeff791"},{"type":"FIX","url":"https://github.com/CoreWCF/CoreWCF/commit/b4867547c94bb088568935d581a55dda18a621e1"},{"type":"PACKAGE","url":"https://github.com/CoreWCF/CoreWCF"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:35.591909545Z"}}