CVE-2026-70035 in .NET
Summary
by MITRE • 10/14/2026
Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described involves the deserialization of untrusted data within the Microsoft .NET Framework, which presents a critical security risk by allowing remote attackers to achieve arbitrary code execution. This class of vulnerabilities stems from the fundamental nature of object serialization in managed environments like .NET, where an application converts complex objects into a format suitable for storage or transmission and subsequently reconstructs them. When this process is applied to data originating from untrusted sources without adequate validation or integrity checks, it creates a pathway for malicious payloads. The attacker crafts a specially formatted serialized object that contains not just benign state information but also executable logic designed to be invoked during the reconstruction phase of deserialization.
From a technical perspective, the flaw lies in how certain .NET serializers handle type instantiation and method invocation automatically upon reading serialized streams. Legacy serializers such as BinaryFormatter are particularly susceptible because they allow the specification of arbitrary types during deserialization. An attacker can manipulate the stream to reference dangerous classes within the framework or loaded assemblies that have side effects when their constructors, finalizers, or specific methods are called. This mechanism bypasses standard input validation controls since the data is not interpreted as raw text but rather as a structured instruction set for object creation and initialization. The attack typically occurs over network protocols where the application accepts serialized payloads from external clients, such as web services, distributed applications, or remote procedure call interfaces.
The operational impact of this vulnerability is severe, resulting in full system compromise equivalent to that achieved through direct code injection attacks. Once the malicious payload executes during deserialization, it runs with the same privileges and security context as the hosting application process. This grants the attacker complete control over the affected system, enabling them to install backdoors, exfiltrate sensitive data, pivot to other systems within the network, or disrupt service availability by crashing critical processes. Because this exploitation does not require user interaction beyond sending a crafted request, it is highly automatable and poses a significant threat in internet-facing applications that process serialized data from unauthenticated users.
This vulnerability aligns with CWE-502, which defines Deserialization of Untrusted Data as the practice of accepting deserialized data without ensuring its integrity or authenticity. In terms of offensive security frameworks, this technique maps to ATT&CK T1190, Exploit Public-Facing Application, and more specifically relates to techniques involving application layer protocols where attackers leverage trusted software features for unauthorized access. The exploitation often involves crafting payloads that trigger specific gadget chains within the .NET framework libraries, a method popularized by tools likeysoserial.net which identify existing classes with dangerous methods that can be chained together to achieve remote code execution without introducing new malicious binaries into the target environment.
Mitigation strategies must focus on eliminating or strictly controlling the use of vulnerable serializers and implementing robust input validation. The most effective long-term solution is to migrate away from legacy binary formatters like BinaryFormatter in favor of safer serialization formats such as JSON with strict type constraints or XML schemas that do not support arbitrary object instantiation. If deserialization of untrusted data cannot be avoided, developers must implement allow-listing mechanisms where only explicitly approved types are permitted during the reconstruction process. Additionally, applying cryptographic signing and integrity verification to serialized payloads ensures that any tampering by an attacker is detected before processing occurs. Regular security assessments and static code analysis tools should also be employed to identify instances of unsafe deserialization patterns within the application codebase.