[4NN4]

PoC from hawktrace - https://hawktrace.com/blog/cve-2025-53772


public static object Deserialize(string str, out Exception handledException) {
    handledException = null;
    BinaryFormatter binaryFormatter = new BinaryFormatter(); // [1]
    byte[] array = Convert.FromBase64String(str); // [2]
    object obj;
    try {
        obj = Base64EncodingHelper.DeserializeHelper(binaryFormatter, array);
    } catch (SerializationException ex) {
        handledException = ex;
        binaryFormatter.Binder = new Base64EncodingHelper.HandleMissingExceptionTypesSerializationBinder();
        obj = Base64EncodingHelper.DeserializeHelper(binaryFormatter, array);
    }
    return obj;
}


private static object DeserializeHelper(BinaryFormatter formatter, byte[] buffer) {
    object obj;
    using (MemoryStream memoryStream = new MemoryStream(buffer)) {
        using (GZipStream gzipStream = new GZipStream(memoryStream, CompressionMode.Decompress)) { // [3]
            obj = formatter.Deserialize(gzipStream); // [4]
        }
    }
    return obj;
}

[warrior00]

You are posting POC's and repositories of other people without their permission. Why can't you create and discover your own CVE and share it with us? don't you have your own discovery?

[4NN4]

Yes I do, kid
Permission? Ahahah, you are funny!:-)))