CVE-2024-53326: LINQPad Unsafe Deserialization RCE Flaw

CVE-2024-53326 Overview

CVE-2024-53326 is an unsafe deserialization vulnerability in LINQPad Pro edition versions before 5.52.01. The flaw exists in the LINQPad.AutoRefManager::PopulateFromCache() method, which deserializes attacker-controlled data without proper type validation. Successful exploitation results in arbitrary code execution in the context of the user running LINQPad. The vulnerability is categorized under [CWE-502] Deserialization of Untrusted Data. Researchers at TrustedSec disclosed the issue and published technical details on their blog.

Critical Impact

Local attackers can achieve code execution by tricking a user into opening a malicious LINQPad cache or script artifact processed by the AutoRefManager component.

Affected Products

• LINQPad Pro edition versions before 5.52.01
• LINQPad.AutoRefManager component (PopulateFromCache() method)
• Windows environments running vulnerable LINQPad installations

Discovery Timeline

• Vulnerability discovered and disclosed by researchers at TrustedSec
• 2026-05-08 - CVE-2024-53326 published to NVD
• 2026-05-08 - Last updated in NVD database

Technical Details for CVE-2024-53326

Vulnerability Analysis

LINQPad is a .NET scripting environment used to query databases and prototype C#, F#, and VB code. The Pro edition includes an auto-reference manager that caches assembly metadata to speed up subsequent script loads. The LINQPad.AutoRefManager::PopulateFromCache() method reads this cached data and reconstructs .NET objects through deserialization. The method does not restrict the types that may be instantiated during the deserialization process.

An attacker who can place or modify a serialized cache file consumed by PopulateFromCache() can supply a gadget chain that executes arbitrary code when the cache is loaded. Code runs with the privileges of the user invoking LINQPad. The attack requires local access and user interaction, but it bypasses the trust boundary typically expected from local cache files.

Root Cause

The root cause is the use of an unsafe .NET deserialization API in PopulateFromCache() without a type filter or SerializationBinder. When .NET formatters such as BinaryFormatter reconstruct objects, they invoke constructors and setters on attacker-chosen types. Known gadget chains in common .NET libraries then chain into process or command execution.

Attack Vector

Exploitation requires the attacker to influence the contents of the LINQPad auto-reference cache. This is typically achieved by writing a crafted cache file to a path that LINQPad reads, or by convincing the target to open a script project containing a poisoned cache. When the user launches LINQPad and the AutoRefManager populates its in-memory state, the malicious payload deserializes and executes. See the TrustedSec disclosure blog for the full technical write-up and gadget chain analysis.

Detection Methods for CVE-2024-53326

Indicators of Compromise

• Unexpected child processes spawned by LINQPad.exe or LPRun.exe, such as cmd.exe, powershell.exe, or rundll32.exe
• Modifications to LINQPad cache files in %LOCALAPPDATA%\LINQPad or user-writable script directories by non-LINQPad processes
• Outbound network connections initiated by LINQPad to non-developer infrastructure

Detection Strategies

• Inspect process telemetry for LINQPad processes loading uncommon .NET assemblies associated with deserialization gadgets, such as System.Workflow.ComponentModel or System.Windows.Forms
• Hunt for serialized BinaryFormatter headers (0x00 01 00 00 00 FF FF FF FF) inside files under LINQPad cache directories
• Correlate LINQPad executions with subsequent suspicious command-line activity using EDR storyline data

Monitoring Recommendations

• Enable PowerShell Script Block Logging and Sysmon Event ID 1 and 11 on developer workstations running LINQPad
• Alert on file writes to LINQPad cache paths originating from processes other than LINQPad itself
• Track installed LINQPad versions across the estate and flag any below 5.52.01

How to Mitigate CVE-2024-53326

Immediate Actions Required

• Upgrade LINQPad Pro to version 5.52.01 or later on all developer endpoints
• Audit existing LINQPad cache directories for unexpected or recently modified files and remove untrusted entries
• Restrict LINQPad usage on shared or multi-user systems where cache files may be writable by other accounts

Patch Information

The vendor resolved the issue in LINQPad 5.52.01. Download the current release from the LINQPad official website. Verify the installed version through Help > About after upgrade.

Workarounds

• Remove the LINQPad auto-reference cache directory and prevent regeneration until the patched version is installed
• Apply NTFS permissions to the LINQPad cache directory so only the owning user can write to it
• Avoid opening LINQPad script projects or queries received from untrusted sources until upgrades are complete

# Verify LINQPad version on Windows (PowerShell)
Get-Item "C:\Program Files (x86)\LINQPad5\LINQPad.exe" |
  Select-Object -ExpandProperty VersionInfo |
  Format-List FileVersion, ProductVersion

# Remove cached auto-reference data
Remove-Item -Recurse -Force "$env:LOCALAPPDATA\LINQPad\AutoRefCache*"