CVE-2026-31235 describes an insecure deserialization vulnerability in the imgaug library (up to version 0.4.0) specifically in the BackgroundAugmenter class's _augment_images_worker() method within multicore.py. The vulnerability is due to untrusted data being deserialized via Python's pickle module from a multiprocessing queue without safety checks. This allows an attacker who can control the queue input to execute arbitrary code in the worker process. The vulnerability is present because pickle inherently allows code execution during deserialization, and no validation or sanitization is performed on the incoming data. No CVSS score or vendor patch information is currently available.

Successful exploitation allows arbitrary code execution within the context of the worker process running the BackgroundAugmenter. This can lead to local or remote code execution depending on deployment and attacker access to the multiprocessing queue. The impact includes potential full compromise of the affected process and any privileges it holds. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running the vulnerable BackgroundAugmenter class with untrusted input or in environments where an attacker can influence the multiprocessing queue data. Consider isolating or sandboxing processes using this library to limit potential impact.