Mescius ActiveReports.NET TypeResolutionService Deserialization of Untrusted Data Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Mescius ActiveReports.NET. The issue arises in the TypeResolutionService class, where user-supplied data is not properly validated, allowing for the deserialization of untrusted data. This vulnerability requires interaction with the library to exploit, and the executed code runs in the context of the current process.

Impact

Exploitation of this vulnerability allows remote attackers to execute arbitrary code on the affected system.

Remediation

The recommended mitigation strategy is to restrict interaction with the product.