Vulnerability · Published May 1, 2026 · Assigned by NCSC.ch

CVE-2026-7584Arbitrary Code Execution via Unsafe Deserialization in LabOne Q

High 7.8

In plain English

A high-severity unsafe deserialization in LabOne Q from Zurich Instruments. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.3%top 82.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The LabOne Q serialization framework uses a class-loading mechanism (import_cls) to dynamically import and instantiate Python classes during deserialization. Prior to the fix, this mechanism accepted arbitrary fully-qualified class names from the serialized data without any validation of the target class or restriction on which modules could be imported. An attacker can craft a serialized experiment file that causes the deserialization engine to import and instantiate arbitrary Python classes with attacker-controlled constructor arguments, resulting in arbitrary code execution in the context of the user running the Python process. Exploitation requires the victim to load a malicious file using LabOne Q's deserialization functions, for example a compromised experiment file shared for collaboration or support purposes.

Affected products (as reported)

Vendor	Product	Versions
Zurich Instruments	LabOne Q	2.41.0 – before 26.1.226.4.0b1 – through 26.4.0b5

Weakness: CWE-502 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

ZI-SA-2026-002 vendor-advisory