This vulnerability is an unsafe deserialization flaw in LINQPad’s AutoRefManager component, located in the PopulateFromCache method. By crafting a malicious cache payload, an attacker can trigger the deserialization routine and execute arbitrary code under the user’s account. The result is full compromise of confidentiality, integrity, and availability for the affected system.

LINQPad Pro editions earlier than version 5.52.01 are vulnerable. All releases prior to this fix are considered at risk. No information is available about other editions or later versions.

The attack vector appears to be local, inferred from the fact that the deserialization occurs when a cache file is loaded during application startup or user activity. The CVSS score of 7.3 indicates a high severity level, while the EPSS score of 4% indicates a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog.