Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization flaw in its .NET Remoting endpoint. A local user can craft YSoSerial.NET BinaryFormatter payloads and send them to the endpoint listening on localhost port 7375, triggering arbitrary code execution with the SYSTEM account. The vulnerability is identical to CWE-502 – insecure deserialization. The impact is a complete compromise of the host, enabling the attacker to modify, delete or exfiltrate any data and install persistence mechanisms.

Seagull Software, LLC’s BarTender 2021 product, versions R1 through 12.0.1 inclusive, is affected. The vulnerable component is BtSystem.Service.exe, which hosts a .NET Remoting listener on TCP port 7375 bound to localhost.

The CVSS score of 8.5 indicates high severity, and while an EPSS score is not provided, the local-only attack surface implies a realistic threat to internally compromised or low-privileged users. The vulnerability is not listed in CISA’s KEV catalog, but the potential to attain SYSTEM privileges results in a catastrophic security breach if exploited.