Insecure deserialization (ARCH304)

Key dotnet.security.insecure-deserialization · Severity error · Category security · CWE CWE-502

Type-preserving deserializers like BinaryFormatter can instantiate arbitrary types from untrusted data, enabling code execution. Use a safe, schema-bound serializer.

Incorrect

var formatter = new BinaryFormatter();
var obj = formatter.Deserialize(untrustedStream);

Correct

var obj = JsonSerializer.Deserialize<Order>(untrustedJson);

Fix

Remove BinaryFormatter/NetDataContractSerializer; deserialize into known types with a safe serializer such as System.Text.Json.