Do not use binary serialization if the serialization stream may come from an untrusted source (eg. remote service, file or database). If you still need to do so (eg. due to compatibility), then it is highly recommended to enable the SafeMode option, which prevents loading assemblies during the deserialization as well as instantiating non-serializable types, and guards against some attacks that may cause OutOfMemoryException. When using SafeMode you must preload every assembly referred by the serialization stream.

Please note though that even some system types can be dangerous. In the .NET Framework there are some serializable types in the fundamental core assemblies that can be exploited for several attacks (causing unresponsiveness, StackOverflowException or even files to be deleted). Starting with .NET Core these types are not serializable anymore and some of them have been moved to separate NuGet packages anyway, but the BinaryFormatter in the .NET Framework is still vulnerable against such attacks. When using the SafeMode flag, the BinarySerializationFormatter is protected against the known security issues on all platforms but of course it cannot guard you against the already loaded potentially harmful types.

Please also note that SafeMode cannot prevent deserializing invalid content if a serializable type does not implement ISerializable and does it not validate the incoming SerializationInfo in its serialization constructor. All serializable types that can have an invalid state regarding the field values should implement ISerializable and should throw a SerializationException from their serialization constructor if validation fails. Other exceptions thrown by the constructor will be wrapped into a SerializationException.

To be completely secured use binary serialization in-process only, or (especially when targeting the .NET Framework), set the Binder property to a SerializationBinder instance that uses strict mapping. For example, you can use the CustomSerializationBinder class with handlers that throw exceptions for unexpected assemblies and types.

Please also note that if the Binder property is set, then using SafeMode cannot prevent loading assemblies by the binder itself. It can just assure that if the binder returns , then the default resolve logic will not allow loading assemblies. The binders in this library that can perform automatic type resolving, such the WeakAssemblySerializationBinder and ForwardedTypesSerializationBinder have their own SafeMode property. If you use them, make sure to set their SafeMode property to  to prevent loading assemblies by the binders themselves.

Similarly, if the SurrogateSelector property is set, then they provide a custom serialization even for types that are not serializable. The surrogate selectors in this library, such as the CustomSerializerSurrogateSelector and NameInvariantSurrogateSelector types have their own SafeMode property. If you use them, make sure to set their SafeMode property to  to prevent deserializing non-serializable types.

• Serializing Enum types will result a longer raw data than serializing their numeric value, though the result will be still shorter than the one produced by BinaryFormatter.
• If KeyValuePairTKey, TValue contains non-natively supported type arguments or DictionaryEntry has non-natively supported keys an values, then for them recursive serialization may occur. If they contain non-serializable types, then the RecursiveSerializationAsFallback option should be enabled.

• Arrays can be single- and multidimensional, jagged (array of arrays) and don't have to be zero index-based. Arrays and other generic collections can be nested.
• If a collection uses a non-default IEqualityComparerT or IComparerT implementation, then it is possible that the type cannot be serialized without enabling RecursiveSerializationAsFallback option, unless the comparer is decorated by SerializableAttribute or implements the IBinarySerializable interface.
• If an Array has Object element type or Object is used in generic arguments of the collections above and an element is not a natively supported type, then recursive serialization of fields may occur. For non-serializable types the RecursiveSerializationAsFallback option might be enabled.
• Even if a generic collection of Object contains natively supported types only, the result will be somewhat longer than in case of a more specific element type.

• If a collection uses a non-default IEqualityComparer or IComparer implementation, then it is possible that the type cannot be serialized without enabling RecursiveSerializationAsFallback option, unless the comparer is decorated by SerializableAttribute or implements the IBinarySerializable interface.
• If an element in these collections is not a natively supported type, then recursive serialization of fields may occur. For non-serializable types the RecursiveSerializationAsFallback option might be enabled.