Mescius ActiveReports.NET ReadValue Deserialization of Untrusted Data Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Mescius ActiveReports.NET. This issue arises from the ReadValue method's improper validation of user-supplied data, allowing for the deserialization of untrusted data. As a result, remote attackers can execute arbitrary code on affected installations, with the executed code running in the context of the current process. Exploitation of this vulnerability requires interaction with the library, and the attack vectors may vary based on the specific implementation.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the current process.

Remediation

Given the nature of the vulnerability, the primary mitigation strategy is to limit interaction with the product.