CVE-2026-25551 is an insecure deserialization vulnerability in Seagull Software BarTender 2021 R1 through 12.0.1. The vulnerability exists in the DataServiceSingleton .NET Remoting endpoint, which listens on localhost TCP port 7375 via BtSystem.Service.exe. The endpoint uses BinaryServerFormatterSinkProvider with TypeFilterLevel set to Full, allowing deserialization of untrusted data. A low-privileged local attacker can exploit this by sending YSoSerial.NET-generated BinaryFormatter payloads to achieve remote code execution with SYSTEM privileges. The vulnerability is local-only due to the endpoint binding to localhost. No patch or official remediation is currently documented.

Successful exploitation allows a low-privileged local user to escalate privileges to NT AUTHORITY\SYSTEM, effectively gaining full control over the affected system. The vulnerability is limited to local attackers due to the localhost binding of the vulnerable endpoint. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to the affected system and monitor for suspicious local activity targeting TCP port 7375. Consider disabling or restricting the BtSystem.Service.exe service if feasible to reduce attack surface.