The vulnerability CVE-2026-7597 affects mem0ai mem0 up to version 1.0.11 and arises from unsafe deserialization in the pickle.load and pickle.dump functions in the file mem0/vector_stores/faiss.py. An attacker can remotely manipulate serialized data to trigger deserialization, which may lead to security risks. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. A patch is available as commit 62dca096f9236010ca15fea9ba369ba740b86b7a, and applying it is the recommended remediation.

Successful exploitation of this vulnerability could allow an attacker to perform malicious deserialization remotely, potentially leading to arbitrary code execution or other unintended behavior within the affected mem0ai mem0 application. The CVSS score of 5.3 reflects a medium severity impact with network attack vector and no user interaction required. There are no reports of active exploitation in the wild at this time.

A patch identified by commit 62dca096f9236010ca15fea9ba369ba740b86b7a is available and should be applied to all affected versions (1.0.0 through 1.0.11) of mem0ai mem0 to remediate this vulnerability. No alternative mitigations or vendor advisory details are provided, so applying the official patch is the recommended action.