The BinaryFormatter , SoapFormatter , and NetDataContractSerializer lacked proper type filtering prior to security updates.