CVE-2026-114157: Local Privilege Escalation via Race Condition in ASP.NET Core Kestrel Named Pipes Transport

Vulnerability ID: CVE-2026-114157
CVSS Score: 7.5
Published: 2026-11-11

CVE-2026-114157 is a high-severity local privilege escalation and security feature bypass vulnerability affecting ASP.NET Core on Microsoft Windows. The flaw resides in the Kestrel web server's Named Pipes transport layer (Microsoft.AspNetCore.Server.Kestrel.Transport.NamedPipes) and stems from a race condition (CWE-362) during broken pipe error recovery. When an active connection throws an IOException during handshake acceptance, the connection listener previously disposed of the broken NamedPipeServerStream instance before acquiring a replacement stream from its internal pool. This sequence created a momentary window where zero server instances of the named pipe existed in the Windows Named Pipe File System (NPFS). A local, low-privileged attacker can exploit this timing window to create a named pipe with the identical name and a permissive Discretionary Access Control List (DACL), hijacking subsequent inter-process communications and escalating privileges across security boundaries.

TL;DR

A race condition (CWE-362) in the ASP.NET Core Kestrel Named Pipes transport layer on Windows disposes of broken pipe streams before creating replacement instances during IOException recovery. Local attackers can exploit this brief namespace vacancy to squat on the named pipe name, override security descriptors, intercept privileged IPC traffic, and escalate privileges.

Technical Details

• Vulnerability ID: CVE-2026-114157
• Weakness Class: CWE-362 (Race Condition)
• Attack Vector: Local (Windows Named Pipes IPC)
• CVSS v3.1 Score: 7.5 High (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N)
• Security Impact: Local Privilege Escalation / Security Feature Bypass
• Affected Component: Microsoft.AspNetCore.Server.Kestrel.Transport.NamedPipes
• Exploit Status: Unproven / No public PoC
• CISA KEV Status: Not Listed

Affected Systems

• ASP.NET Core Kestrel Server (Named Pipes Transport on Windows)
• Microsoft .NET 8.0 Runtime & SDK on Windows
• Microsoft .NET 9.0 Runtime & SDK on Windows
• Microsoft .NET 10.0 Runtime & SDK on Windows
• Microsoft .NET 11.0 Preview Runtime & SDK on Windows
• Microsoft Visual Studio 2022
• Microsoft Visual Studio 2026
• .NET 8.0: >= 8.0.0, < 8.0.34 (Fixed in: 8.0.34)
• .NET 9.0: >= 9.0.0, < 9.0.23 (Fixed in: 9.0.23)
• .NET 10.0: >= 10.0.0, < 10.0.15 (Fixed in: 10.0.15)
• .NET 11.0: >= 11.0.0-preview.1, < 11.0.0 (Fixed in: 11.0.0)
• Visual Studio 2022 (v17.14): >= 17.14.0, < 17.14.45 (Fixed in: 17.14.45)
• Visual Studio 2026 (v18.11): >= 18.11.0, < 18.11.4 (Fixed in: 18.11.4)
• Visual Studio 2026 (v18.12): = 18.12.0 (Fixed in: 18.12.1)

Code Analysis

Commit: 671bb7f

Fix race condition in NamedPipeConnectionListener by creating replacement stream before disposing broken stream (release/8.0)

File: src/Servers/Kestrel/Transport.NamedPipes/src/Internal/NamedPipeConnectionListener.cs
@@ -129,9 +129,18 @@ private async Task StartAsync(NamedPipeServerStream nextStream)
                 // WaitForConnectionAsync can throw IOException when the pipe is broken.
                 NamedPipeLog.ConnectionListenerBrokenPipe(_log, ex);

-                // Dispose existing pipe, create a new one and continue accepting.
-                nextStream.Dispose();
-                nextStream = _namedPipeServerStreamPool.Get();
+                // Create a new pipe and continue accepting. We create the new one before disposing
+                // the broken one to ensure there is always a created stream and another process
+                // can't create a stream with the same name with a different access policy.
+                var brokenStream = nextStream;
+                try
+                {
+                    nextStream = _namedPipeServerStreamPool.Get();
+                }
+                finally
+                {
+                    brokenStream.Dispose();
+                }
             }
             catch (OperationCanceledException) when (_listeningToken.IsCancellationRequested)
             {

Commit: a4ade6a

Fix race condition in NamedPipeConnectionListener by creating replacement stream before disposing broken stream (release/9.0)

File: src/Servers/Kestrel/Transport.NamedPipes/src/Internal/NamedPipeConnectionListener.cs
@@ -129,9 +129,18 @@ private async Task StartAsync(NamedPipeServerStream nextStream)
                 // WaitForConnectionAsync can throw IOException when the pipe is broken.
                 NamedPipeLog.ConnectionListenerBrokenPipe(_log, ex);

-                // Dispose existing pipe, create a new one and continue accepting.
-                nextStream.Dispose();
-                nextStream = _namedPipeServerStreamPool.Get();
+                // Create a new pipe and continue accepting. We create the new one before disposing
+                // the broken one to ensure there is always a created stream and another process
+                // can't create a stream with the same name with a different access policy.
+                var brokenStream = nextStream;
+                try
+                {
+                    nextStream = _namedPipeServerStreamPool.Get();
+                }
+                finally
+                {
+                    brokenStream.Dispose();
+                }
             }
             catch (OperationCanceledException) when (_listeningToken.IsCancellationRequested)
             {

Mitigation Strategies

• Upgrade the ASP.NET Core Shared Framework and .NET Runtime on all Windows hosts to the November 2026 servicing releases (.NET 8.0.34, .NET 9.0.23, .NET 10.0.15, or .NET 11.0.0).
• Rebuild and redeploy any self-contained ASP.NET Core applications targeting Windows that use Microsoft.AspNetCore.Server.Kestrel.Transport.NamedPipes.
• Configure NamedPipeClientStream clients to restrict token impersonation levels (using TokenImpersonationLevel.Anonymous or Identification) when connecting to local IPC endpoints.
• Monitor Kestrel diagnostic logs for anomalous spikes in ConnectionListenerBrokenPipe events and audit Windows Security Event ID 5145 / Sysmon Event ID 17 (PipeEvent - Pipe Created) for unauthorized processes creating known service pipe names.

Remediation Steps:

1. Inventory all Windows servers and workstations running .NET 8.0, 9.0, 10.0, 11.0-preview, or Visual Studio 2022/2026 using dotnet --list-runtimes.
2. Download and install the patched ASP.NET Core Hosting Bundle / Runtime installer (8.0.34, 9.0.23, 10.0.15, or 11.0.0) from Microsoft.
3. Update Visual Studio 2022 instances to 17.14.45+ and Visual Studio 2026 instances to 18.11.4+ or 18.12.1+ via the Visual Studio Installer.
4. Restart affected Windows services and IIS/Kestrel worker processes to ensure the updated runtime assemblies are loaded into memory.
5. Recompile and redeploy any self-contained .NET deployments that utilize Kestrel's UseNamedPipes() transport configuration.

References

• Microsoft Security Update Guide: CVE-2026-114157
• Official CVE Record: CVE-2026-114157
• GitHub Fix Commit for .NET 8.0 (671bb7f9c84e24153ac8440e4e6de307a6cbd920)
• GitHub Fix Commit for .NET 9.0 (a4ade6a6848f06681af1a57b5a7b555647d3e19d)
• ASP.NET Core v8.0.34 Release Tag
• ASP.NET Core v9.0.23 Release Tag
• ASP.NET Core v10.0.15 Release Tag
• MITRE ATT&CK Search for CVE-2026-114157

Read the full report for CVE-2026-114157 on our website for more details including interactive diagrams and full exploit analysis.