CVE-2026-25551

Seagull Software BarTender Deserialization Privilege Escalation via .NET Remoting Service

Published Jun 4, 2026 CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Description

Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack surface to local access only. The endpoint is configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. A low-privileged local attacker can send YSoSerial.NET-generated BinaryFormatter payloads to the localhost-bound endpoint to achieve code execution as NT AUTHORITY\\\\SYSTEM. The vulnerability was corrected in BarTender 12.1, released on August 14, 2026. Users should upgrade to BarTender 12.1 or later.

Analysis

Technical impact

Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that permits low‑privileged local users to elevate to SYSTEM. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe. The listener is configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full, allowing a low‑privileged local attacker to send YSoSerial.NET-generated BinaryFormatter payloads that trigger arbitrary code execution as the SYSTEM account. This flaw maps to CWE‑502 – insecure deserialization, and leads to a full compromise of the host including data modification, exfiltration, and persistence installation.

Affected Systems

Seagull Software, LLC’s BarTender 2021 product, versions R1 through 12.0.1 inclusive, is affected. The vulnerable component is BtSystem.Service.exe, which hosts a .NET Remoting listener on TCP port 7375 bound to localhost.

Risk and Exploitability

The CVSS score of 8.5 indicates high severity, and the EPSS score of 0.0013 (<1%) indicates a low overall likelihood of exploitation. However, the local‑only attack surface means that an attacker with low‑privileged local access could realistically gain SYSTEM privileges. This vulnerability is not listed in CISA’s KEV catalog, and attainment of SYSTEM privileges would constitute a catastrophic security breach.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Seagull Software, LLC.

BarTender 2021

affected

Version	Status	Constraints
`R1`	affected	≤ 12.0.1

No data.

Vendor Product Versions

Seagull

Bartender 2021

Version	Status	Scheme	Platform
`[R1,12.0.1]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply any available vendor update or patch that removes the insecure deserialization behavior in BarTender 2021.
If a patch is not immediately available, stop or disable BtSystem.Service.exe or block its listening socket on TCP port 7375 to deny local access to the vulnerable endpoint.
Increase local user restrictions, audit for any unexpected execution of the BarTender service, and monitor system logs for suspicious activity on port 7375.

Generated by OpenCVE AI on September 3, 2026 at 15:48 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.132% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://gist.github.com/VAMorales/dde5b1c0415a8505ccd6fafdb095a618
https://portal.seagullscientific.com/downloads/bartender
https://trust.seagullsoftware.com/?tcuUid=55ed135f-683c-4e9b-a59d-7d4373c0ac7e
https://www.vulncheck.com/advisories/seagull-software-bartender-deserialization-privilege-escalation-via-net-remoting-service

History

Sep 2, 2026 4:30 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack surface to local access only. The endpoint is configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. A low-privileged local attacker can send YSoSerial.NET-generated BinaryFormatter payloads to the localhost-bound endpoint to achieve code execution as NT AUTHORITY\\SYSTEM.	Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack surface to local access only. The endpoint is configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. A low-privileged local attacker can send YSoSerial.NET-generated BinaryFormatter payloads to the localhost-bound endpoint to achieve code execution as NT AUTHORITY\\\\SYSTEM. The vulnerability was corrected in BarTender 12.1, released on August 14, 2026. Users should upgrade to BarTender 12.1 or later.
References		https://trust.seagullsoftware.com/?tcuUid=55ed135f-683c-4e9b-a59d-7d4373c0ac7e

Jun 8, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 5, 2026 10:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Seagull Seagull bartender 2021
Vendors & Products		Seagull Seagull bartender 2021

Jun 4, 2026 5:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack surface to local access only. The endpoint is configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. A low-privileged local attacker can send YSoSerial.NET-generated BinaryFormatter payloads to the localhost-bound endpoint to achieve code execution as NT AUTHORITY\\SYSTEM.
Title		Seagull Software BarTender Deserialization Privilege Escalation via .NET Remoting Service
Weaknesses		CWE-502
References		https://gist.github.com/VAMorales/dde5b1c0415a8505ccd6fafdb095a618 https://portal.seagullscientific.com/downloads/bartender https://www.vulncheck.com/advisories/seagull-software-bartender-deserialization-privilege-escalation-via-net-remoting-service
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`