The vulnerability in LabOne Q's serialization framework involves unsafe deserialization due to the import_cls mechanism accepting arbitrary fully-qualified class names from serialized data without validation. This flaw enables an attacker to execute arbitrary Python code by crafting a malicious experiment file that triggers the import and instantiation of attacker-controlled classes with controlled constructor arguments. The vulnerability affects specific versions of LabOne Q and requires the victim to load the malicious file. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability, with attack vector local and requiring user interaction.

Successful exploitation leads to arbitrary code execution within the context of the user running the LabOne Q Python process. This can compromise confidentiality, integrity, and availability of the affected system. The attack requires the victim to load a malicious serialized experiment file, typically shared for collaboration or support, making social engineering a likely vector. No known exploits in the wild have been reported as of the publication date.

No official patch or remediation has been published by Zurich Instruments at this time. Users should exercise caution when opening experiment files from untrusted or unknown sources to avoid loading malicious serialized data. Monitor vendor advisories for updates on patches or official mitigations. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.