CVE-2026-25551

Name of the Vulnerable Software and Affected Versions Seagull Software BarTender versions 2021 R1 through 12.0.1

Description Insecure deserialization occurs in the DataServiceSingleton .NET Remoting endpoint, which is bound to localhost on TCP port 7375 via BtSystem.Service.exe. The endpoint is configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. This allows a low-privileged local attacker to send BinaryFormatter payloads to the endpoint to achieve code execution as NT AUTHORITYSYSTEM, resulting in privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.