BinaryFormatter or a comparable formatter Deserialize call allows arbitrary type instantiation and remote code execution.
Replace BinaryFormatter and similar formatters with a safe serializer such as System.Text.Json without type name handling.