CVE-2026-25551: Seagull Software BarTender Deserialization Privilege Escalation via .NET Remoting Service

Synopsis

Insecure deserialization in Seagull Software BarTender (versions 2021 R1 through 12.0.1) allows a low-privileged local user to escalate to SYSTEM-level privileges. The vulnerable component is the DataServiceSingleton .NET Remoting endpoint, bound to localhost on TCP port 7375 by BtSystem.Service.exe, which accepts BinaryFormatter payloads without safe type filtering. An attacker with any local account on the host can send a crafted serialized payload to execute arbitrary code as NT AUTHORITY\SYSTEM. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The vulnerable endpoint is bound to localhost only; an attacker needs an existing shell or process on the host rather than any network path.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or elevated credentials are needed to reach the endpoint.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker sends the payload directly to the listening service.

• Attack complexityDetail

  Exploitation is reliable and condition-free; pre-built payload generators such as YSoSerial.NET produce working BinaryFormatter payloads without requiring special timing or environment layout.

Blast Radius

• Executes arbitrary code as NT AUTHORITY\SYSTEM, giving the attacker full control of the host operating system.
• Reads any file, credential store, or secret accessible to the SYSTEM account, including secrets held by other services on the same host.
• Modifies or deletes any file, registry key, or process on the host, enabling persistent implantation or sabotage of other workloads.
• Crashes or disables the BarTender service and any dependent print or labeling workflows running on the host.