Deserialization of Untrusted Data in Mescius ActiveReports.NET

CVE-2025-6811

What is CVE-2025-6811?

The Mescius ActiveReports.NET contains a vulnerability within the TypeResolutionService class, which permits remote code execution via the deserialization of untrusted user data. Due to insufficient validation mechanisms, attackers leveraging this flaw can execute arbitrary code in the context of the affected process. This attack requires interaction with the TypeResolutionService, and the specific method of exploitation may depend on the unique implementation of the library in each environment. Awareness and prompt remediation are essential to safeguard against potential exploitation.

References