This vulnerability is an instance of unsafe deserialization in LINQPad’s AutoRefManager component, specifically in the PopulateFromCache() method. The flaw allows an attacker to execute arbitrary code within the context of a user’s environment. It aligns with CWE‑502: Deserialization of Untrusted Data, which can lead to full compromise of confidentiality, integrity, and availability for the affected system.

LINQPad Pro edition versions prior to 5.52.01 are affected. All earlier releases must be considered vulnerable. No data is available about other editions or versions.

The CVSS score is not provided, and EPSS data is unavailable, so the exact likelihood of exploitation is unclear. Since the vulnerability involves deserialization of cache data, it is likely exploitable when a user opens a crafted cache file, making the attack vector local rather than remote. The vulnerability is not listed in the CISA KEV catalog.