# Unsafe deserialization of attacker-chosen types

Deserializers or loaders that instantiate classes or types named in untrusted input

_Area: Memory corruption and native code. Seen in 3 disclosed reports; latest 2023-11-02. Updated 2026-10-24._

## How it works
A deserializer is handed data that names a type, and it trusts that name. Instead of only filling a fixed, expected class, it resolves the name from input and instantiates whatever it finds. The broken assumption is that the input can only select types the developer intended. Once an attacker controls the type name (or a format that maps directly to object construction), they choose which constructors, setters and side effects run. Reflection may also populate fields before the constructor, so validation inside the constructor never sees the attacker's values [E1](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-exploiting-memory-corruption-vulnerabilities-on-android.md).

## Where it shows up
- Wrappers that store a `className` string plus a JSON/blob and pass both to Gson/Jackson or similar [E1](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-exploiting-memory-corruption-vulnerabilities-on-android.md)
- Protocol unmarshallers that accept a class/type field from the wire (e.g. OpenWire) [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-vulnerability-exploitation-of-apache-activemq-cve-2023-46604.md)
- Document or project formats that are XAML or other markup mapping to object instantiation, loaded via `XamlReader` [E3](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-10-iconics-genesis64.md)
- Exported activities or entry points that auto-deserialize intent extras [E1](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-exploiting-memory-corruption-vulnerabilities-on-android.md)
- Any loader that resolves types by name from a file, socket or extra without an allowlist

## How to review
Find every deserialization/load call and ask: can the input choose the type? The invariant that must hold is that the set of instantiable types is fixed by code, not by data — an explicit allowlist, or a format that cannot express arbitrary types. Check that field population cannot bypass constructor validation [E1](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-exploiting-memory-corruption-vulnerabilities-on-android.md). For markup loaders, confirm sandboxing or a restricted schema [E3](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-10-iconics-genesis64.md). For protocols, confirm the type field is validated against known-safe classes before instantiation [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-vulnerability-exploitation-of-apache-activemq-cve-2023-46604.md).

## Variants seen
- Parcelable wrapper carrying className + JSON into a Gson-style parser, reaching native-pointer classes [E1](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-exploiting-memory-corruption-vulnerabilities-on-android.md)
- Network protocol unmarshalling attacker-chosen classes that fetch remote config, leading to RCE [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-vulnerability-exploitation-of-apache-activemq-cve-2023-46604.md)
- Project file as unsandboxed WPF XAML instantiating `ObjectDataProvider` to launch processes [E3](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-10-iconics-genesis64.md)

## Impact and severity
High to critical: memory corruption and data leakage [E1](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-exploiting-memory-corruption-vulnerabilities-on-android.md), remote code execution with ransomware deployment [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-vulnerability-exploitation-of-apache-activemq-cve-2023-46604.md), and arbitrary code execution from an opened project file [E3](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-10-iconics-genesis64.md). Severity rises when the entry point is remotely reachable [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-vulnerability-exploitation-of-apache-activemq-cve-2023-46604.md) or auto-triggered by an exported component or file open [E1](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-exploiting-memory-corruption-vulnerabilities-on-android.md)[E3](https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-10-iconics-genesis64.md), and when reflection runs before validation [E1](https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-exploiting-memory-corruption-vulnerabilities-on-android.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-exploiting-memory-corruption-vulnerabilities-on-android.md
- E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-vulnerability-exploitation-of-apache-activemq-cve-2023-46604.md
- E3: https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-10-iconics-genesis64.md