# .NET BinaryFormatter Deserialization

> Detects use of BinaryFormatter, SoapFormatter, and NetDataContractSerializer which are insecure for untrusted data.

- Skill: `zakirkun/net-binaryformatter-deserialization` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/net-binaryformatter-deserialization`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/net-binaryformatter-deserialization/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/net-binaryformatter-deserialization

---


# .NET BinaryFormatter Deserialization

## Overview
`BinaryFormatter` and related .NET serializers are inherently insecure when used with untrusted data. Microsoft has officially deprecated `BinaryFormatter` in .NET 5+ due to its inability to be secured.

Gadget chains from ysoserial.net can achieve RCE through ViewState, remoting, and other attack surfaces.

## Remediation
- Use `System.Text.Json` or `Newtonsoft.Json` with schema validation
- Microsoft recommends `System.Text.Json` as the secure replacement
- If migration is not possible, validate/whitelist types before deserialization