CVE-2026-25551 json
Seagull Software BarTender Deserialization Privilege Escalation via .NET Remoting Service
published 2026-06-04 5 mo ago modified 2026-09-02 2 mo ago also EUVD-2026-34306
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 2%
- public exploits
- 0
- none known
Summary
Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack surface to local access only. The endpoint is configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. A low-privileged local attacker can send YSoSerial.NET-generated BinaryFormatter payloads to the localhost-bound endpoint to achieve code execution as NT AUTHORITY\\\\SYSTEM. The vulnerability was corrected in BarTender 12.1, released on August 14, 2026. Users should upgrade to BarTender 12.1 or later.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 5 mo ago
Exploit prediction
0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- gist.github.com https://gist.github.com/VAMorales/dde5b1c0415a8505ccd6fafdb095a618 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Seagull Software, LLC. BarTender 2021
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
trust.seagullsoftware.com
/?tcuUid=55ed135f-683c-4e9b-a59d-7d4373c0ac7e
vendor-advisory, patch
-
gist.github.com
/VAMorales/dde5b1c0415a8505ccd6fafdb095a618
technical-description, exploit
-
portal.seagullscientific.com
/downloads/bartender
product
-
vulncheck.com
/advisories/seagull-software-bartender-deserialization-privilege-escalation-via-net-remoting-service
third-party-advisory
Sources
- CVE List CVE-2026-25551
- NVD CVE-2026-25551
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.