CVE-2026-25551: CWE-502 Deserialization of Untrusted Data in Seagull Software, LLC. BarTender 2021
Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack surface to local access only. The endpoint is configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. A low-privileged local attacker can send YSoSerial.NET-generated BinaryFormatter payloads to the localhost-bound endpoint to achieve code execution as NT AUTHORITY\\SYSTEM.
AI Analysis
Technical Summary
CVE-2026-25551 is a CWE-502 insecure deserialization vulnerability affecting Seagull Software BarTender 2021 R1 through 12.0.1. The DataServiceSingleton .NET Remoting endpoint, exposed locally on TCP port 7375 via BtSystem.Service.exe, uses BinaryServerFormatterSinkProvider with TypeFilterLevel set to Full. This configuration allows a low-privileged local attacker to send malicious BinaryFormatter payloads generated by YSoSerial.NET to achieve remote code execution as the SYSTEM user. The vulnerability is limited to local privilege escalation due to the endpoint binding to localhost only.
Potential Impact
A low-privileged local attacker can exploit this vulnerability to execute arbitrary code with NT AUTHORITY\SYSTEM privileges, resulting in full system compromise. The attack is limited to local access, so remote exploitation is not possible without prior local access.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict local access to the affected service and monitor for suspicious local activity targeting TCP port 7375. Consider disabling or restricting the BtSystem.Service.exe if feasible.
CVE-2026-25551: CWE-502 Deserialization of Untrusted Data in Seagull Software, LLC. BarTender 2021
Description
Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack surface to local access only. The endpoint is configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. A low-privileged local attacker can send YSoSerial.NET-generated BinaryFormatter payloads to the localhost-bound endpoint to achieve code execution as NT AUTHORITY\\SYSTEM.
CVSS v4.0
Score 8.5high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-25551 is a CWE-502 insecure deserialization vulnerability affecting Seagull Software BarTender 2021 R1 through 12.0.1. The DataServiceSingleton .NET Remoting endpoint, exposed locally on TCP port 7375 via BtSystem.Service.exe, uses BinaryServerFormatterSinkProvider with TypeFilterLevel set to Full. This configuration allows a low-privileged local attacker to send malicious BinaryFormatter payloads generated by YSoSerial.NET to achieve remote code execution as the SYSTEM user. The vulnerability is limited to local privilege escalation due to the endpoint binding to localhost only.
Potential Impact
A low-privileged local attacker can exploit this vulnerability to execute arbitrary code with NT AUTHORITY\SYSTEM privileges, resulting in full system compromise. The attack is limited to local access, so remote exploitation is not possible without prior local access.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict local access to the affected service and monitor for suspicious local activity targeting TCP port 7375. Consider disabling or restricting the BtSystem.Service.exe if feasible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-02-02T20:12:33.395Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a21ba77e29bf47b50be41fa
Added to database: 06/04/2026, 17:48:39 UTC
Last enriched: 06/12/2026, 09:52:52 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 74
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.