Which versions of Seagull BarTender are affected by CVE-2026-25551?

BarTender printing software versions 2021 R1 through 12.0.1 contain a privilege escalation vulnerability that allows any user with local system access to gain administrative control, creating risk of…

Is there a public PoC exploit available for CVE-2026-25551?

Yes, a public proof-of-concept exploit is available for CVE-2026-25551. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25551?

Within 24 hours: Inventory all BarTender installations to identify affected versions (2021 R1 through 12.0.1) and assess user access patterns. Within 7 days: Implement compensating controls (restrict local access, disable .NET Remoting, enable EDR monitoring) and contact Seagull Software for patch timeline. Within 30 days: Execute remediation-either upgrade to unaffected BarTender versions or implement network isolation for affected systems pending vendor guidance.

Seagull BarTender CVE-2026-25551

Q: What is the CVSS score of CVE-2026-25551?

CVE-2026-25551 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34306 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-04 VulnCheck

GHSA-g42f-xxvf-qj27

Deserialization RCE Bartender 2021

8.5

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 04, 2026 - 18:30 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 04, 2026 - 18:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 04, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

Jun 04, 2026 - 18:22 NVD

7.8 (HIGH) 8.5 (HIGH)

Analysis Generated

Jun 04, 2026 - 18:04 vuln.today

DescriptionCVE.org

Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack surface to local access only. The endpoint is configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. A low-privileged local attacker can send YSoSerial.NET-generated BinaryFormatter payloads to the localhost-bound endpoint to achieve code execution as NT AUTHORITY\\SYSTEM.

AnalysisAI

Local privilege escalation in Seagull Software BarTender 2021 R1 through 12.0.1 allows any low-privileged user on the host to gain SYSTEM execution by sending a crafted BinaryFormatter payload to a localhost-bound .NET Remoting endpoint. Publicly available exploit code exists (a YSoSerial.NET-based PoC is published as a GitHub gist), and the issue carries a CVSS 4.0 base score of 8.5 with high confidentiality, integrity, and availability impact. No CISA KEV listing is present, so exploitation is opportunistic rather than confirmed in-the-wild.

Technical ContextAI

BarTender's BtSystem.Service.exe exposes a DataServiceSingleton object via legacy .NET Remoting bound to 127.0.0.1:7375. The channel is configured with BinaryServerFormatterSinkProvider and, critically, TypeFilterLevel set to Full - a setting Microsoft explicitly warns enables arbitrary type deserialization and is unsafe for any untrusted input. This is a textbook CWE-502 (Deserialization of Untrusted Data) flaw: tools such as YSoSerial.NET can generate BinaryFormatter gadget chains (TypeConfuseDelegate, TextFormattingRunProperties, etc.) that trigger code execution during deserialization. Because the service runs as NT AUTHORITY\SYSTEM, any code reached through the gadget chain inherits SYSTEM privileges, turning a deserialization sink into a full local EoP primitive.

RemediationAI

Patch availability per vendor advisory is referenced via the Seagull download portal at https://portal.seagullscientific.com/downloads/bartender - upgrade BarTender past 12.0.1 to the latest build that disables or hardens the DataServiceSingleton .NET Remoting endpoint, and confirm the fixed version against the VulnCheck advisory at https://www.vulncheck.com/advisories/seagull-software-bartender-deserialization-privilege-escalation-via-net-remoting-service since an exact fix version was not included in the provided data. Where immediate patching is not possible, compensating controls include blocking inbound traffic to localhost TCP/7375 with a Windows Filtering Platform rule (note this will break any legitimate client of BtSystem.Service.exe and may impair BarTender print/administration features), restricting interactive and remote-desktop logon to the affected hosts to trusted administrators only, and using AppLocker or WDAC to prevent execution of untrusted binaries by standard users so a low-privileged attacker cannot deliver the YSoSerial.NET payload in the first place. Monitor BtSystem.Service.exe for child-process creation as SYSTEM as a high-fidelity detection signal.